Executive brief
MeshCentral is a web-based remote monitoring and management platform that allows administrators to control and monitor devices across networks. A compromised or rogue agent can inject malicious HTML/JavaScript into device fields (such as OS description) that are stored without sanitization and later displayed in the admin dashboard. When an administrator views device details, the injected payload executes in their browser with full privileges, allowing attackers to steal credentials, perform unauthorized actions, or compromise the entire management infrastructure.
Technical details
This is a stored cross-site scripting (XSS) vulnerability resulting from insufficient input validation and output encoding. The vulnerability occurs in the agent message handler (meshagent.js:1903), which accepts the osdesc (OS description) field with only a type check (typeof == 'string'), storing it directly in the database without HTML sanitization. When administrators view the device details panel, this data is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing any embedded JavaScript. Additional unescaped fields include node.name, cpuinfo.thermals[].InstanceName, and volumes[].name. The Content Security Policy includes 'unsafe-inline', providing no protection. Attack vector is network-based; a rogue or compromised MeshAgent can inject the payload via WebSocket. The payload fires automatically when any admin views device details—no user interaction beyond the admin loading the page is required. Patches are available in version 1.1.60 and later.
Affected products
- Ylianst MeshCentral <1.1.60
Timeline
- 2026-08-18: disclosed: Published as GHSA-c7hr-448w-65px
- 2026-08-18: patched: Fixed in version 1.1.60