Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-61876 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
• https://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting

Recommended action

Review the upstream advisory, identify the affected product in your inventory, and apply the vendor update when one is available.

What this means

CVE-2026-61876 is listed in the HOL Guard supply-chain feed, but affected software is not mapped to a package. Review the upstream advisory for the affected product and vendor guidance. LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.

Affected software

Affected software not mapped. Review the upstream record for vendor-specific product and version guidance.

Evidence and references

• https://github.com/openwrt/luci/security/advisories/GHSA-686p-p8p9-x6fh
• https://www.vulncheck.com/advisories/luci-dhcpv6-lease-hostname-stored-cross-site-scripting