{"id":"CVE-2026-126495","summary":"MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips","details":"MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.","modified":"2026-11-15T02:30:30.974594895Z","published":"2026-11-11T00:58:48.843Z","database_specific":{"cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126495.json","cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/126xxx/CVE-2026-126495.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126495"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips"},{"type":"REPORT","url":"https://github.com/emqx/MQTTX/issues/2180"},{"type":"PACKAGE","url":"https://github.com/emqx/MQTTX"},{"type":"ARTICLE","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283"},{"type":"ARTICLE","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184"},{"type":"ARTICLE","url":"https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/emqx/mqttx","events":[{"introduced":"0"},{"last_affected":"766c9327177885dc233c0e39d0735136256563e1"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"1.13.3"}],"source":"AFFECTED_FIELD"},{"source":"DESCRIPTION","range":[{"introduced":"0"},{"last_affected":"1.13.3"}]}]}}],"versions":["v1.13.3","v1.13.2","v1.13.1","v1.13.0","v1.12.1","v1.12.1-beta.1","v1.12.0","v1.12.0-beta.4","v1.12.0-beta.3","v1.12.0-beta.2","v1.12.0-beta.1","v1.11.1","v1.11.0","v1.10.1","v1.10.0","v1.9.10","v1.9.9","v1.9.8","v1.9.7","v1.9.6","v1.9.5","v1.9.4","v1.9.3","v1.9.2","v1.9.1","v1.9.1-beta.2","v1.9.1-beta.1","v1.9.0","v1.8.3","v1.8.2","v1.8.1","v1.8.0","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.2","v1.6.1","v1.6.0","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.2","v1.4.1","v1.4.0","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.3","v1.2.2","v1.2.0","v1.1.1","v1.1.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-126495.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N"}]}