Executive brief
MeshCentral is a remote device management platform that allows administrators to monitor and control computers across networks. A compromised or rogue agent can inject malicious JavaScript code through device description fields, which are then executed in the browser of any administrator viewing device details. This allows attackers to steal admin session cookies, modify device configurations, or perform actions on behalf of the administrator.
Technical details
The vulnerability exists in MeshCentral's agent-to-database-to-UI pipeline. Agent input validation (meshagent.js:1903) only checks that osdesc is a string, performing no HTML/JS sanitization. The field is stored as-is in the database. When rendering in the web UI (default3.handlebars:8713), the value is passed to addDeviceAttribute() → QH() which sets innerHTML without calling EscapeHtml(), despite this function being used inconsistently elsewhere in the codebase. Additional unescaped fields include node.name (in sharing/permission dialogs), cpuinfo.thermals[].InstanceName, and volumes[].name. Server-side defense is absent: CloneSafeNode() and validateObjectForMongo() do not sanitize for XSS. The attack requires a compromised agent (which may connect unauthenticated or via a legitimate device enrollment), but execution occurs with admin privileges when the admin views the device panel—no click required. The CSP header includes 'unsafe-inline', permitting inline event handlers. A rogue agent sends a WebSocket coreinfo message with JavaScript in the osdesc field; when any admin visits the device details page, the payload fires in their session context. Version 1.1.60 patches this by adding output encoding.
Affected products
- Ylianst MeshCentral < 1.1.60
Timeline
- 2026-06-11: disclosed: GHSA-c7hr-448w-65px published
- 2026: patched: Version 1.1.60 released with HTML sanitization fixes
- 2026-08-18: advisory: GitHub Advisory Database updated