Description
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.
Affected products
jpettitt: meshcore card
References2
- github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg… ExploitMitigationVendor Advisory
- github.com/jpettitt/meshcore-card/security/advisories/GHSA-5vrg… ExploitMitigationVendor Advisory
Metrics
- CVSS 3.1
-
9.6
CRITICAL
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - EPSS — exploit probability
- 0% percentile: 25 · as of 15 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.