Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

High severity, with a CVSS score of 8.3, published 18 August 2026.

Is there a fix for This vulnerability?

A patch was published on 2026: Version 1.1.60 released with HTML sanitization fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network.

Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

MeshCentral stored XSS via unsanitized agent fields

Severity: high · CVSS 8.3 · Published 2026-08-18

MeshCentral is a remote device management platform that allows administrators to monitor and control computers across networks. A compromised or rogue agent can inject malicious JavaScript code through device description fields, which are then executed in the browser of any administrator viewing device details. This allows attackers to steal admin session cookies, modify device configurations, or perform actions on behalf of the administrator.

Technologies: Ylianst MeshCentral. Vendors: Ylianst.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: High severity, with a CVSS score of 8.3, published 18 August 2026.
Which products and versions are affected?: Ylianst MeshCentral < 1.1.60.
Is there a fix for This vulnerability?: A patch was published on 2026: Version 1.1.60 released with HTML sanitization fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network.
Am I affected?: Check whether you run Ylianst MeshCentral at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in MeshCentral's agent-to-database-to-UI pipeline. Agent input validation (meshagent.js:1903) only checks that osdesc is a string, performing no HTML/JS sanitization. The field is stored as-is in the database. When rendering in the web UI (default3.handlebars:8713), the value is passed to addDeviceAttribute() → QH() which sets innerHTML without calling EscapeHtml(), despite this function being used inconsistently elsewhere in the codebase. Additional unescaped fields include node.name (in sharing/permission dialogs), cpuinfo.thermals[].InstanceName, and volumes[].name. Server-side defense is absent: CloneSafeNode() and validateObjectForMongo() do not sanitize for XSS. The attack requires a compromised agent (which may connect unauthenticated or via a legitimate device enrollment), but execution occurs with admin privileges when the admin views the device panel—no click required. The CSP header includes 'unsafe-inline', permitting inline event handlers. A rogue agent sends a WebSocket coreinfo message with JavaScript in the osdesc field; when any admin visits the device details page, the payload fires in their session context. Version 1.1.60 patches this by adding output encoding.

Affected products

Ylianst MeshCentral < 1.1.60

Timeline

2026-06-11: disclosed: GHSA-c7hr-448w-65px published
2026: patched: Version 1.1.60 released with HTML sanitization fixes
2026-08-18: advisory: GitHub Advisory Database updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.