CVE-2026-126495: MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips

Q: Who is exposed to this issue?

MQTTX Desktop users are exposed when they connect to a broker controlled by an attacker or subscribe to topics that an attacker can publish to. The vulnerable content is a malicious MQTT topic name or payload displayed in Topic Tree or JSON tree tooltips.

Q: What user interaction is required for exploitation?

The victim must hover over a Topic Tree or JSON tree node that renders the attacker-controlled topic name or payload in a tooltip. No attacker authentication or local account is indicated by the supplied CVSS vector.

Q: Why is execution in the desktop application significant?

The injected script executes in the Electron renderer, where nodeIntegration is enabled. This makes renderer-side script execution more consequential than XSS confined to a typical browser page.

Q: What can be done if updating is not immediately possible?

Avoid connecting MQTTX Desktop to untrusted or attacker-controlled brokers, and avoid subscribing to topics where untrusted parties can publish malicious topic names or payloads. Do not hover Topic Tree or JSON tree entries originating from untrusted MQTT data.

Published Nov 11, 2026

Updated

MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.

Affected Software

1 affected component

emqx MQTTX Desktop<=1.13.3

Event History

Nov 11, 2026

CVE Published

via MITRE·12:58 AM

Data Sourced

via MITRE·12:58 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

MQTTX Desktop users are exposed when they connect to a broker controlled by an attacker or subscribe to topics that an attacker can publish to. The vulnerable content is a malicious MQTT topic name or payload displayed in Topic Tree or JSON tree tooltips.

What user interaction is required for exploitation?

The victim must hover over a Topic Tree or JSON tree node that renders the attacker-controlled topic name or payload in a tooltip. No attacker authentication or local account is indicated by the supplied CVSS vector.

Why is execution in the desktop application significant?

The injected script executes in the Electron renderer, where nodeIntegration is enabled. This makes renderer-side script execution more consequential than XSS confined to a typical browser page.

What can be done if updating is not immediately possible?

Avoid connecting MQTTX Desktop to untrusted or attacker-controlled brokers, and avoid subscribing to topics where untrusted parties can publish malicious topic names or payloads. Do not hover Topic Tree or JSON tree entries originating from untrusted MQTT data.

CVE-2026-126495: MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What user interaction is required for exploitation?

Why is execution in the desktop application significant?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What user interaction is required for exploitation?

Why is execution in the desktop application significant?

What can be done if updating is not immediately possible?