CVE-2026-45323

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-45323

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45323.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-45323

Aliases

GHSA-5vrg-xpcj-xppc

Published

2026-05-28T16:54:32.847Z

Modified

2026-07-15T01:49:16.547808067Z

Severity

9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator

Summary

MeshCore Card: XSS vulnerability through meshcore node name

Details

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45323.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/jpettitt/meshcore-card

Affected ranges

Type

GIT

Repo

https://github.com/jpettitt/meshcore-card

Events

Introduced

Fixed

23d01e4165dfbf92e31ed65e1a17d40314e2a1fc

Database specific

{
    "cpe": "cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.3.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v0.*

v0.0.1

v0.1.0

v0.2.0

v0.3.1

v0.3.2

v1.*

v1.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-45323.json"