---
id: "CVE-2026-129358"
page: "https://infrastack.ai/live/CVE-2026-129358"
kind: "vulnerability"
aliases: ["CVE-2026-129358"]
title: "Linux Foundation Magma NMS: cross-site scripting in handleReact route"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["linux-foundation", "magma", "other", "self-hosted", "telecom"]
not_affected_if: ["nms-not-deployed"]
published_at: "2026-11-15T03:16:51+00:00"
first_seen_at: "2026-11-15T03:33:39+00:00"
updated_at: "2026-11-15T03:34:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-129358", "first_seen_at": "2026-11-15T03:33:39+00:00"}]
exploit_sources: []
---

# Linux Foundation Magma NMS: cross-site scripting in handleReact route

Link for people: https://infrastack.ai/live/CVE-2026-129358 (this .md is for agents)

Magma up to 1.9.0 has a cross-site scripting flaw in the NMS route handler handleReact in nms/server/main/routes.ts. An attacker can run scripts in a logged-in user's browser session through a crafted request.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Magma release; versions up to and including `1.9.0` are listed as affected.
- Look for the NMS component in your deployment and confirm whether it is reachable from outside your network.

## Timeline

- 2026-11-15T03:33:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-129358

## From the sources

A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_