by Kastro
Paper/Archive/CVE-2026-45323

CVE-2026-45323

jpettitt meshcore-card — MeshCore Card: XSS vulnerability through meshcore node name

EPSS 0.3%public exploitCVSS 9.6
critical.is priorityof 100
44
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 24.6.246 × 204.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

Affected

ProductAffectedFixed inSource
meshcore-card< 0.3.3–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc