Medium severity6.1NVD Advisory· Published Nov 11, 2026
CVE-2026-126495
CVE-2026-126495
Description
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/emqx/MQTTX/blob/v1.13.3/src/background.tsnvd
- github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vuenvd
- github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vuenvd
- github.com/emqx/MQTTX/issues/2180nvd
- www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltipsnvd
News mentions
0No linked articles in our index yet.