CVE-2026-45323CWE-79

MeshCore Card: XSS vulnerability through meshcore node name

Critical · published May 28, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00476 · 40.2th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-05-28T16:54Z
EPSS history
Timeline
  • 28 MAY 16:54Z
    MeshCore Card: XSS vulnerability through meshcore node name
    cvelistv5