CVE-2026-61876 Details
Description
LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
A cross-site scripting vulnerability has been identified in LuCI versions prior to the patch in the master branch. The issue arises because DHCPv6 lease hostnames are not properly encoded before being displayed in status tables. This flaw allows adjacent network attackers to inject HTML markup, including script tags, into the DHCP lease pages. When an administrator views these pages, the injected scripts are executed in their browser.
To address this vulnerability, wrap untrusted hostname or IP strings in 'document.createTextNode()' or array syntax before passing them to the LuCI table update functions. This change will ensure that the data is treated as plain text rather than HTML. Additionally, preserve any intentional markup, such as line breaks, using DOM nodes instead of raw strings.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 12, 2026 | New CVE Received | [email protected] |