ByteOS Network

NVD Vulnerability Details :

CVE-2026-45323

Analyzed

Source-security-advisories@github.com

Published At-28 May, 2026 | 18:16

Updated At-03 Jun, 2026 | 18:34

MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 9.6

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CPE Matches

jpettitt>>meshcore_card>>Versions before 0.3.3(exclusive)

cpe:2.3:a:jpettitt:meshcore_card:*:*:*:*:*:home_assistant:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	security-advisories@github.com

CWE ID: CWE-79

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	security-advisories@github.com	Exploit Mitigation Vendor Advisory
https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc	134c704f-9b21-4f2e-91b3-4a467353bcc0	Exploit Mitigation Vendor Advisory

Hyperlink: https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc

Source: security-advisories@github.com

Resource:

Exploit

Mitigation

Vendor Advisory

Hyperlink: https://github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg-xpcj-xppc

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource:

Exploit

Mitigation

Vendor Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History