CVE-2026-45323

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	Exploit Mitigation Vendor Advisory
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	Exploit Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*

History

26 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) MeshCore Card proporciona la tarjeta MeshCore Lovelace para Home Assistant. Antes de 0.3.3, los nombres de los nodos Meshcore se renderizan sin escape HTML en meshcore-card, permitiendo que cualquier nodo dentro del alcance de radio directo o indirecto (repetido) ejecute javascript arbitrario en el frontend de Home Assistant de cualquiera que vea la tarjeta. Esta vulnerabilidad se corrige en 0.3.3.

Information

Published : 2026-05-28 18:16

Updated : 2026-10-26 13:10

NVD link : CVE-2026-45323

Mitre link : CVE-2026-45323

CVE.ORG link : CVE-2026-45323

JSON object : View

Products Affected

jpettitt

meshcore_card

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-45323", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-45323", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-29T15:30:23.116991Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "jpettitt", "product": "meshcore-card", "versions": [{"status": "affected", "version": "< 0.3.3"}]}]}], "published": "2026-05-28T18:16:35.300", "references": [{"url": "https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3."}, {"lang": "es", "value": "MeshCore Card proporciona la tarjeta MeshCore Lovelace para Home Assistant. Antes de 0.3.3, los nombres de los nodos Meshcore se renderizan sin escape HTML en meshcore-card, permitiendo que cualquier nodo dentro del alcance de radio directo o indirecto (repetido) ejecute javascript arbitrario en el frontend de Home Assistant de cualquiera que vea la tarjeta. Esta vulnerabilidad se corrige en 0.3.3."}], "lastModified": "2026-10-26T13:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*", "vulnerable": true, "matchCriteriaId": "DE771B70-62C7-4988-A506-BB732727942B", "versionEndExcluding": "0.3.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}