{"id":"CVE-2026-129358","kind":"vulnerability","aliases":["CVE-2026-129358"],"related":[],"title":"Linux Foundation Magma NMS: cross-site scripting in handleReact route","description":"A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.","summary":"Magma up to 1.9.0 has a cross-site scripting flaw in the NMS route handler handleReact in nms/server/main/routes.ts. An attacker can run scripts in a logged-in user's browser session through a crafted request.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-foundation","magma","other","self-hosted","telecom"],"not_affected_if":["nms-not-deployed"],"how_to_check":"- Check the installed Magma release; versions up to and including `1.9.0` are listed as affected.\n- Look for the NMS component in your deployment and confirm whether it is reachable from outside your network.","fix":null,"status":"open","published_at":"2026-11-15T03:16:51+00:00","first_seen_at":"2026-11-15T03:33:39+00:00","triaged_at":"2026-11-15T03:34:47+00:00","updated_at":"2026-11-15T03:34:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-15T03:34:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Linux Foundation Magma NMS: cross-site scripting in handleReact route","impact":"medium","summary":"Magma up to 1.9.0 has a cross-site scripting flaw in the NMS route handler handleReact in nms/server/main/routes.ts. An attacker can run scripts in a logged-in user's browser session through a crafted request.","audience":"businesses","category":"other","nicknames":[],"who_cares":["magma","linux-foundation","telecom","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in an operator's browser, possibly stealing session data","analyst_note":"Confirm the fixed version and whether NMS login is required; the NVD record names no fix, and the vendor did not respond to disclosure.","how_to_check":"- Check the installed Magma release; versions up to and including `1.9.0` are listed as affected.\n- Look for the NMS component in your deployment and confirm whether it is reachable from outside your network.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["nms-not-deployed"],"who_is_affected":"Teams running Magma's NMS (network management system) web interface, where the affected route is served. The sources do not say whether the flaw needs an account, so assume the NMS login is required until confirmed. Installations where the NMS is not exposed to users or the internet are lower risk.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000734,"input_tokens":4573,"output_tokens":553,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-129358':14A,17A '-2026':13A,16A '1.9.0':30B,74C 'attack':47B,101C 'avail':107C 'browser':58B 'compon':86C 'contact':115C 'craft':62B 'cross':6A,34B,92C 'cross-sit':5A,33B 'cve':12A,15A 'disclosur':119C 'earli':116C 'exploit':104C 'file':82C 'flaw':37B 'foundat':2A,20B,70C 'function':78C 'handler':42B 'handlereact':10A,43B,79C 'host':25B 'identifi':67C 'impact':75C 'launch':99C 'lead':90C 'linux':1A,19B,69C 'linux-found':18B 'log':54B 'logged-in':53B 'magma':3A,21B,27B,71C 'manipul':89C 'might':109C 'nms':4A,40B,87C 'nms/server/main/routes.ts':45B,83C 'possibl':97C 'public':106C 'remot':102C 'request':63B 'respond':123C 'rout':11A,41B 'run':49B 'script':8A,36B,50B,94C 'self':24B 'self-host':23B 'session':59B 'site':7A,35B,93C 'telecom':26B 'use':111C 'user':56B 'vendor':113C 'vulner':65C 'way':126C","nicknames":[],"mitigations":[],"who_affected":"Teams running Magma's NMS (network management system) web interface, where the affected route is served. The sources do not say whether the flaw needs an account, so assume the NMS login is required until confirmed. Installations where the NMS is not exposed to users or the internet are lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linuxfoundation","low","magma","other","selfhosted","telecom"],"campaign_type":null,"search_a":"'-129358':14A,17A '-2026':13A,16A 'cross':6A 'cross-sit':5A 'cve':12A,15A 'foundat':2A 'handlereact':10A 'linux':1A 'magma':3A 'nms':4A 'rout':11A 'script':8A 'site':7A","search_b":"'1.9.0':30B 'attack':47B 'browser':58B 'craft':62B 'cross':34B 'cross-sit':33B 'flaw':37B 'foundat':20B 'handler':42B 'handlereact':43B 'host':25B 'linux':19B 'linux-found':18B 'log':54B 'logged-in':53B 'magma':21B,27B 'nms':40B 'nms/server/main/routes.ts':45B 'request':63B 'rout':41B 'run':49B 'script':36B,50B 'self':24B 'self-host':23B 'session':59B 'site':35B 'telecom':26B 'user':56B","search_c":"'1.9.0':74C 'attack':101C 'avail':107C 'compon':86C 'contact':115C 'cross':92C 'disclosur':119C 'earli':116C 'exploit':104C 'file':82C 'foundat':70C 'function':78C 'handlereact':79C 'identifi':67C 'impact':75C 'launch':99C 'lead':90C 'linux':69C 'magma':71C 'manipul':89C 'might':109C 'nms':87C 'nms/server/main/routes.ts':83C 'possibl':97C 'public':106C 'remot':102C 'respond':123C 'script':94C 'site':93C 'use':111C 'vendor':113C 'vulner':65C 'way':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T03:16:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129358","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129358","severity":null,"published_at":"2026-11-15T03:16:51+00:00","modified_at":"2026-11-15T03:16:51+00:00","first_seen_at":"2026-11-15T03:33:39+00:00","fetched_at":"2026-11-15T03:33:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}