Threats tagged 'ghsa-55f4-qr9r-gp5r'

MQTTX desktop versions up to 1.13.3 have a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers who control an MQTT broker or publish to subscribed topics to inject malicious scripts via MQTT topic names or payloads. These scripts execute in the Electron renderer process with nodeIntegration enabled when victims hover over certain UI elements, such as Topic Tree or JSON tree nodes. The vulnerability has a CVSS score of 6.1, indicating medium severity.