CVE-2026-45323: MeshCore Card: XSS vulnerability through meshcore node name

Synopsis

This is a stored cross-site scripting (XSS) vulnerability in meshcore-card, the MeshCore Lovelace card for Home Assistant. It is reachable over the network and requires no authentication from the attacker; however, a victim must view the affected card in their Home Assistant frontend for the exploit to trigger. Successful exploitation gives the attacker full script execution in the victim's browser context, enabling data theft, account takeover, and arbitrary UI manipulation. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious node name over the network; the affected Home Assistant frontend must be reachable or the attacker's MeshCore node must be within direct or repeated radio range that eventually reaches the target's network.

• AuthenticationNot required

  No credentials are needed on the attacker's side; any MeshCore node within radio range can inject the malicious name without authenticating to the target system.

• Victim interactionRequired

  A victim must open or view the meshcore-card in their Home Assistant frontend for the injected script to execute, making this a social-engineering or passive-wait scenario.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites beyond the victim viewing the card.

Blast Radius

• Reads session tokens, authentication cookies, and any secrets visible in the Home Assistant frontend, potentially handing the attacker full account access.
• Executes arbitrary JavaScript in the victim's browser, allowing the attacker to make authenticated API calls to Home Assistant on the victim's behalf.
• Modifies the Home Assistant UI or injects persistent payloads that affect other users who view the same dashboard.
• Disrupts the victim's Home Assistant session or triggers actions against connected smart-home devices controlled through the frontend.