Executive brief
MeshCore Card is a dashboard component for Home Assistant used to display information about mesh network nodes. A security flaw allows an attacker within radio range of the mesh network to send a specially crafted node name that executes malicious code in a user's web browser. If an administrator views the dashboard, the attacker could gain full control over the Home Assistant instance, including the ability to control smart home devices or access sensitive data.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in meshcore-card prior to version 0.3.3 due to improper neutralization of input during web page generation. The 'adv_name' attribute, which represents the advertised name of a node on a LoRa mesh network, is rendered in the Home Assistant Lovelace frontend without HTML escaping. An attacker within radio range can broadcast a malicious node name containing a JavaScript payload. When a user views a dashboard containing the MeshCore card, the payload executes in the context of their session. This can lead to full account takeover, extraction of authentication tokens, and if the victim is an administrator, remote code execution (RCE) via the Home Assistant API.
Affected products
- jpettitt meshcore-card < 0.3.3
Timeline
- 2026-05-08: advisory: GitHub security advisory published
- 2026-05-28: disclosed: CVE published to NVD