CVE-2026-126495 · Other
NO FIX YET
MQTTX desktop, an MQTT client app, renders MQTT topic names and payloads unescaped in tooltips. An attacker who controls a broker or can publish to a subscribed topic can run script in the app's Electron renderer when a user hovers over a Topic Tree or JSON tree node.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that use the MQTTX desktop client to inspect MQTT brokers, especially against brokers or topics that other parties can publish to. The flaw is in the desktop app's Electron renderer, which has nodeIntegration enabled, so it does not concern a server deployment. Teams that only use a different MQTT client or do not run the desktop app can skip it.
Not affected if not-desktop-app, trusted-brokers-only
Who cares desktop, electron, mqtt, mqttx
through 1.13.3No fix yet, per the sources.
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.