Threats affecting pkg:github/jpettitt/meshcore-card

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.6	EPSS 0.3%	CVE-2026-45323jpettitt meshcore-card · Cross-site Scripting Critical9.6EPSS 0.3%2026-05-28CVE Database V5CVE-2026-45323 CVE-2026-45323 is a critical cross-site scripting (XSS) vulnerability in the jpettitt meshcore-card for Home Assistant. Versions prior to 0.3.3 render meshcore node names without proper HTML escaping, enabling any node within radio range to execute arbitrary JavaScript in the frontend of users viewing the card. This vulnerability allows an attacker to compromise confidentiality, integrity, and availability of the affected system. The issue is fixed in version 0.3.3. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-05-28

Page 1 of 1