CVE-2026-126495— MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips

Quick assessment

Affected

emqx MQTTX

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MQTTX 桌面版（1.13.3 及更早版本）存在存储型跨站脚本（XSS）漏洞。攻击者可通过发布恶意的 MQTT 主题名称或载荷，利用工具提示（tooltip）中未转义渲染的内容注入脚本。若攻击者能够控制 MQTT 代理（broker）或向受害者已订阅的主题发布消息，当受害者将鼠标悬停在“主题树”（Topic Tree）或"JSON 树”节点上时，即可在启用了 nodeIntegration 的 Electron 渲染进程中执行恶意脚本。

CVSS 6.1 · Medium Updated Nov 11, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips

Source: CVE Program / CVE List V5

Vulnerability Description

MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

在Web页面生成时对输入的转义处理不恰当(跨站脚本)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
emqx	MQTTX	0 ~ 1.13.3	-

II. Public POCs for CVE-2026-126495

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-126495

请登录查看更多情报信息。

Other References for CVE-2026-126495 (6)

https://github.com/emqx/MQTTX product
https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184 technical-description
https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226 technical-description
https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283 technical-description
https://github.com/emqx/MQTTX/issues/2180 issue-tracking
https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-126495

IV. Related Vulnerabilities

Same product: MQTTX

CVE-2025-62413
MQTTX vulnerable to cross-site scripting via improper messag

Same vendor: emqx

Same weakness: CWE-79