CVE-2026-45323
Last modified
CVE-2026-45323 is a critical-severity vulnerability rated 9.6/10 on the CVSS scale. MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. EPSS estimates a 0.32% chance of exploitation in the next 30 days.
Description
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Jpettitt | Meshcore Card | < 0.3.3 |
References
- https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppcExploit, Mitigation, Vendor Advisory
- https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppcExploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-45323?
How severe is CVE-2026-45323?
How do I fix CVE-2026-45323?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-45317Open WebUI is a self-hosted artificial intelligence platform…4.6
- CVE-2026-45318Open WebUI is a self-hosted artificial intelligence platform…5.4
- CVE-2026-4532A security vulnerability has been detected in code-projects …7.5
- CVE-2026-45320DataEase is an open source data visualization and analysis t…8.7
- CVE-2026-45321On 2026-05-11, between approximately 19:20 and 19:26 UTC, 84…9.6
- CVE-2026-45322Microsoft UFO open-source framework for intelligent automati…7.8
- CVE-2026-45324Rizin is a UNIX-like reverse engineering framework and comma…3.3
- CVE-2026-45325Gestor de Oferta is a web application for managing mobility …8.2
- CVE-2026-45327TinyIce is a streaming server for audio and video. In versio…8.2
- CVE-2026-45328ESF-IDF is the Espressif Internet of Things (IOT) Developmen…8.8
- CVE-2026-45329ESF-IDF is the Espressif Internet of Things (IOT) Developmen…6.5
- CVE-2026-4533A vulnerability was detected in code-projects Simple Food Or…8.8
Are you affected by CVE-2026-45323?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST