CVE-2026-61876LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

Description

LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

References and patches

• GitHub Security Advisory (GHSA-686p-p8p9-x6fh) vendor-advisory
• VulnCheck Advisory: LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting third-party-advisory