VulnSocial

CVE-2026-45323Disclosure(jpettitt / meshcore_card)

LOWCVSS 9.6 · CRITICAL

Signal is active with 3 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

jpettitt CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Exploit / PoC references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • meshcore_card

Threat summary

  • 3 mentions across 1 observed day

What's happening

  • Technical details provided in 3 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • 3 total mentions across 1 day

Affected systems

Vendors
jpettitt
Products
meshcore_card

Deep dive

Activity timeline3 mentions / 1d
01223Mentions · 2026-05-28: 3Technical Details · 2026-05-28: 305-28
Signal classification2 categories
Disclosure
266.7%
General
133.3%
Referenced assets4 URLs
Full discourse3 posts
  • Vulmon Vulnerability Feed@VulmonFeeds
    General

    CVE-2026-45323 Cross-Site Scripting in MeshCore Lovelace Card for Home A... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45323 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2

    Post summary

    The tweet merely references CVE-2026-45323 as a Cross‑Site Scripting issue in MeshCore Lovelace Card for Home Assistant, linking to a vulnerability database without providing deeper details, proof‑of‑concepts, exploitation evidence, patches, or false‑positive claims.

    0000060
    4.0K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2026-45323 MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing an… https://www.cve.org/CVERecord?id=CVE-2026-45323 ----- Traducción: CVE-2026-45323 Mes… http://infoflow.cloud`

    Post summary

    CVE-2026-45323 identifies an HTML‑escaping flaw in MeshCore Lovelace cards before v0.3.3, potentially enabling XSS; no proof‑of‑concept, exploit code, or active exploitation is reported.

    0000064
    79 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-45323 MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing an… https://www.cve.org/CVERecord?id=CVE-2026-45323

    Post summary

    The excerpt describes an XSS flaw in the MeshCore Lovelace card (CVE‑2026‑45323) where node names lack HTML escaping before version 0.3.3, but provides no PoC, exploit, or patch details.

    00000257
    57.5K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appjpettittmeshcore_card-home_assistant-

Explore more

Back to dashboardjpettitt CVEsmeshcore_card vulnerabilities