CVE-2026-45323

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	Exploit Mitigation Vendor Advisory
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*

History

No history.

Information

Published : 2026-05-28 18:16

Updated : 2026-06-17 10:51

NVD link : CVE-2026-45323

Mitre link : CVE-2026-45323

CVE.ORG link : CVE-2026-45323

JSON object : View

Products Affected

jpettitt

meshcore_card

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-45323", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45323", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T15:30:23.116991Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jpettitt", "product": "meshcore-card", "versions": [{"status": "affected", "version": "< 0.3.3"}]}]}], "published": "2026-05-28T18:16:35.300", "references": [{"url": "https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3."}], "lastModified": "2026-06-17T10:51:55.200", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*", "vulnerable": true, "matchCriteriaId": "DE771B70-62C7-4988-A506-BB732727942B", "versionEndExcluding": "0.3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}