Post #3071566

2026-06-03 10:58 UTC

I found that crafted MeshCore node names could compromise Home Assistant instances running meshcore-card, with an XSS leading to remote root access on the HA host. An attacker could then access anything controlled or visible through Home Assistant. The attacker doesn't need to be near the target, as MeshCore advertisements are repeated over the mesh, which is dense in NL. This also affects around 20 public MeshCore analyzer websites. Some of those run CoreScope, where it looks like a vibecoding bot broke the XSS filter while hallucinating a bugfix. The analyzers are mostly public data though. In addition, the less popular MeshCore-Home-Assistant-Panel-v2 is likely also affected, but I was unable to make contact with the maintainer. MeshCore node names are only 32 bytes, and each rendered in a different place in the page, so I had to be creative to run a more substantial payload. I found a way with three node names using an iframe feature I never heard of before. https://mxsasha.eu/posts/meshcore-xss-home-assistant/

Replies (14)

@meph@social.treehouse.systems 2026-06-03 18:13

@sash@hachyderm.io This is incredible, fantastic work @sash@hachyderm.io Not sure if you saw a week or so ago, but some folks in the PNW figured out you could just @everyone in the meshcore public channel and it would cause a bunch of monitor bots on a bunch of discord servers to massping.

Open ##3096000
@Taco_lad@aus.social 2026-06-03 11:28

@sash@hachyderm.io @xssfox@cloudisland.nz FYI

Open ##3226160
@henk@waag.social 2026-06-03 12:55

@sash@hachyderm.io nice catch (and clearly documented) Sasha! #meshcore #homeassistant

Open ##3226162
@jeroen@secluded.ch 2026-06-03 13:35

@sash@hachyderm.io Nice find, work and writeup! Escaping things and having a sane CSP policy is such a hard thing for crap-coded things…. because with a proper CSP this would not have been such a big issue; of course, properly escaping things is the better route…

Open ##3226163
@litchralee_v6@ipv6.social 2026-06-03 15:12

@sash@hachyderm.io Excellent write-up! While reading, I had the thought of possible mitigation in the #meshcore firmware, such as dropping adverts that contain node names with "http://". But TIL, relative URIs allow omitting the scheme. So ultimately, sanitizing the node names before presentation is the most robust solution, exactly as your write-up concludes.

Open ##3226164
@StumpyTheMutt@social.linux.pizza 2026-06-03 16:15

@sash@hachyderm.io Brilliant! It's incredible to me that so many people are eager to accept slop-coded bug "fixes" like that nonfunctional filter.

Open ##3226167
@klikini@pnw.zone 2026-06-03 16:32

@sash@hachyderm.io I clicked the first link in your article and suddenly everything made sense 😆

Open ##3226168
@lunareclipse@snug.moe 2026-06-03 19:01

@sash@hachyderm.io HomeAssistant's stance on this is Fun. Maybe I should turn everything into plain MQTT and then use idk, NodeRed? Does that have RBAC? Can I write JavaScript to program behaviors? Need to research.

Open ##3226171
@tomgag@infosec.exchange 2026-06-03 19:09

@sash@hachyderm.io that's pretty cool!

Open ##3226172
@max@toet.dnzm.nl 2026-06-03 20:18

@sash@hachyderm.io where it looks like a vibecoding bot broke the XSS filter while hallucinating a bugfix. Because of fucking course. 🥸

Open ##3226173
@fdlamotte@mamot.fr 2026-06-04 04:19

@sash@hachyderm.io really interesting, thanks for your work !

Open ##3226174
@po3mah@mastodon.social 2026-06-04 17:01

@sash@hachyderm.io Thank you. I just installed the addon and the card and wanted to connect to my meshcore companion. Rolling back.

Open ##3226175
@rothko@beige.party 2026-06-05 01:57

@sash@hachyderm.io @mathew@universeodon.com

Open ##3226177
@Daniel_Blake@mastodon.top 2026-06-07 15:08

@sash@hachyderm.io @Unixbigot@aus.social @happyborg@fosstodon.org

Open ##3226178