The jpettitt meshcore-card for Home Assistant versions before 0.3.3 improperly neutralize input during web page generation by rendering meshcore node names without HTML escaping. This flaw (CWE-79) enables an attacker controlling any node within direct or indirect radio range to inject and execute arbitrary JavaScript in the Home Assistant frontend of users who view the card. The vulnerability has a CVSS 3.1 score of 9.6, indicating critical severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability. The vulnerability is resolved in version 0.3.3.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the Home Assistant frontend, potentially leading to full compromise of user sessions, data theft, and disruption of service. The vulnerability affects all users running meshcore-card versions prior to 0.3.3. There are no known exploits in the wild at this time.

Upgrade meshcore-card to version 0.3.3 or later where this vulnerability is fixed. Since the vendor has released a fixed version, applying this official update is the recommended remediation. No additional mitigations are indicated by the vendor advisory.