The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an administrator pointing the URL at an attacker-controlled server achieves persistent cross-site scripting affecting every user who views any device showconfig tab. Fixed in 26.5.0 by commit 6782af94 (PR 19660), which wraps all five sinks in the e() escaping helper. Note: the upstream advisory states the fix is 26.7.0, but showconfig.inc.php is byte-identical between 26.6.1 and 26.7.0 and all five sinks were already escaped as of 26.5.0.