{"id":"CVE-2026-126495","kind":"vulnerability","aliases":["CVE-2026-126495"],"related":[],"title":"MQTTX desktop: stored XSS via MQTT topics runs script in app","description":"MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.","summary":"MQTTX desktop, an MQTT client app, renders MQTT topic names and payloads unescaped in tooltips. An attacker who controls a broker or can publish to a subscribed topic can run script in the app's Electron renderer when a user hovers over a Topic Tree or JSON tree node.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["desktop","electron","mqtt","mqttx","other"],"not_affected_if":["not-desktop-app","trusted-brokers-only"],"how_to_check":"- Check the installed MQTTX desktop version against the affected range `through 1.13.3`\n- Confirm whether you subscribe to brokers or topics you do not fully trust","fix":null,"status":"open","published_at":"2026-11-11T01:17:14+00:00","first_seen_at":"2026-11-11T01:24:33+00:00","triaged_at":"2026-11-11T01:25:51+00:00","updated_at":"2026-11-11T01:25:51+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T01:25:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"MQTTX desktop: stored XSS via MQTT topics runs script in app","impact":"high","summary":"MQTTX desktop, an MQTT client app, renders MQTT topic names and payloads unescaped in tooltips. An attacker who controls a broker or can publish to a subscribed topic can run script in the app's Electron renderer when a user hovers over a Topic Tree or JSON tree node.","audience":"developers","category":"other","nicknames":[],"who_cares":["mqtt","mqttx","electron","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Script runs in the app's renderer when a user hovers a node.","analyst_note":"Confirm the fixed version and any patch from the NVD page or the VulnCheck advisory; the sources here do not state one.","how_to_check":"- Check the installed MQTTX desktop version against the affected range `through 1.13.3`\n- Confirm whether you subscribe to brokers or topics you do not fully trust","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-desktop-app","trusted-brokers-only"],"who_is_affected":"Teams that use the MQTTX desktop client to inspect MQTT brokers, especially against brokers or topics that other parties can publish to. The flaw is in the desktop app's Electron renderer, which has nodeIntegration enabled, so it does not concern a server deployment. Teams that only use a different MQTT client or do not run the desktop app can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4622,"output_tokens":573,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126495':14A,17A '-2026':13A,16A '1.13.3':74C 'allow':84C 'app':11A,27B,55B 'attack':38B,85C,101C 'broker':42B,104C 'client':26B 'contain':75C 'control':40B,102C 'cross':79C 'cross-sit':78C 'cve':12A,15A 'desktop':2A,18B,23B,72C 'electron':19B,57B,115C 'enabl':120C 'execut':111C 'hover':62B,123C 'inject':87C 'json':68B,127C 'malici':91C 'mqtt':6A,20B,25B,29B,92C 'mqttx':1A,21B,22B,71C 'name':31B,94C 'node':70B,129C 'nodeintegr':119C 'payload':33B,96C 'publish':45B,90C,106C 'render':28B,58B,97C,116C 'run':8A,51B 'script':9A,52B,81C,88C,112C 'site':80C 'store':3A,77C 'subscrib':48B,108C 'tooltip':36B,100C 'topic':7A,30B,49B,65B,93C,109C,124C 'tree':66B,69B,125C,128C 'unescap':34B,98C 'user':61B 'via':5A 'victim':122C 'vulner':82C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Teams that use the MQTTX desktop client to inspect MQTT brokers, especially against brokers or topics that other parties can publish to. The flaw is in the desktop app's Electron renderer, which has nodeIntegration enabled, so it does not concern a server deployment. Teams that only use a different MQTT client or do not run the desktop app can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["desktop","electron","medium","mqtt","mqttx","other"],"campaign_type":null,"search_a":"'-126495':14A,17A '-2026':13A,16A 'app':11A 'cve':12A,15A 'desktop':2A 'mqtt':6A 'mqttx':1A 'run':8A 'script':9A 'store':3A 'topic':7A 'via':5A 'xss':4A","search_b":"'app':27B,55B 'attack':38B 'broker':42B 'client':26B 'control':40B 'desktop':18B,23B 'electron':19B,57B 'hover':62B 'json':68B 'mqtt':20B,25B,29B 'mqttx':21B,22B 'name':31B 'node':70B 'payload':33B 'publish':45B 'render':28B,58B 'run':51B 'script':52B 'subscrib':48B 'tooltip':36B 'topic':30B,49B,65B 'tree':66B,69B 'unescap':34B 'user':61B","search_c":"'1.13.3':74C 'allow':84C 'attack':85C,101C 'broker':104C 'contain':75C 'control':102C 'cross':79C 'cross-sit':78C 'desktop':72C 'electron':115C 'enabl':120C 'execut':111C 'hover':123C 'inject':87C 'json':127C 'malici':91C 'mqtt':92C 'mqttx':71C 'name':94C 'node':129C 'nodeintegr':119C 'payload':96C 'publish':90C,106C 'render':97C,116C 'script':81C,88C,112C 'site':80C 'store':77C 'subscrib':108C 'tooltip':100C 'topic':93C,109C,124C 'tree':125C,128C 'unescap':98C 'victim':122C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T01:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126495","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126495","severity":null,"published_at":"2026-11-11T01:17:14+00:00","modified_at":"2026-11-11T01:17:14+00:00","first_seen_at":"2026-11-11T01:24:33+00:00","fetched_at":"2026-11-11T01:24:33+00:00","note":null}],"documents":[{"id":121273,"url":"https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}