Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| librenms/librenms | composer | < 24.9.0 | 24.9.0 |
Miggo AIRoot Cause AnalysisThe root cause of the vulnerability is the lack of HTML escaping when rendering the output of the displayDetails() method in the alert transports view. The displayDetails() method in the Transport class processes user input from transport details fields (like host, user, etc.) and returns it without sanitization. The view (includes/html/print-alert-transports.php) then directly outputs this unsanitized data using nl2br($instance->displayDetails()), which allowed injected scripts to execute. The patch explicitly added htmlentities() around the displayDetails() call in the view, confirming that missing output encoding was the critical flaw. While the view's rendering code is technically the execution point, the function responsible for providing the raw data (displayDetails()) is the primary vulnerable component when combined with improper output handling.
