Meshcore Card
Approved changes feed: RSS · Atom
cpe:2.3:a:jpettitt:meshcore-card:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Jpettitt (05ae6938-486f-5f84-b816-b98e2f1a26e2) |
|---|---|
| Product | Meshcore Card (8b821501-a494-5289-b6eb-e78967ea3748) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-45323 |
vulnerable | 2026-06-08 08:05:11.692104 |
MeshCore Card: XSS vulnerability through meshcore node name
CRITICAL (9.6)
MeshCore Card provides MeshCore Lovelace card for Home Assistant. Prior to 0.3.3, Meshcore node names are rendered without HTML escaping in meshcore-card, allowing any node within direct or indirect (repeated) radio range to execute arbitrary javascript in the Home Assistant frontend of anyone viewing the card. This vulnerability is fixed in 0.3.3.
Published: 2026-05-28T16:54:32.847Z
Updated: 2026-05-29T15:30:28.175Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.