CVE-2026-129358 · Other
NO FIX YET
Magma up to 1.9.0 has a cross-site scripting flaw in the NMS route handler handleReact in nms/server/main/routes.ts. An attacker can run scripts in a logged-in user's browser session through a crafted request.
first public Nov 15, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams running Magma's NMS (network management system) web interface, where the affected route is served. The sources do not say whether the flaw needs an account, so assume the NMS login is required until confirmed. Installations where the NMS is not exposed to users or the internet are lower risk.
Not affected if nms-not-deployed
Who cares linux-foundation, magma, self-hosted, telecom
1.9.0 are listed as affected.No fix yet, per the sources.
A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.