Stored Cross-Site Scripting in MQTTX Desktop by EMQX

CVE-2026-126495

What is CVE-2026-126495?

MQTTX Desktop up to version 1.13.3 is susceptible to stored cross-site scripting (XSS) attacks due to improper handling of MQTT topic names and payloads. This vulnerability allows attackers controlling an MQTT broker to inject malicious scripts into the application. When users hover over nodes in the Topic Tree or JSON tree views, the scripts can execute in the Electron renderer, potentially compromising users' data and sessions. It highlights the critical need for enhanced input validation and output encoding to safeguard against such exploits.

References