CVE-2026-45323

9.6 Critique

Publiée le 28/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:51 · Analysée par le NVD · Source : security-advisories@github.com

Description

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

Traduire en français

Produits concernés

jpettitt meshcore-card
Jpettitt meshcore card

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.6 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc ExploitMitigationVendor Advisory
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc ExploitMitigationVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories