MQTTX: Stored cross-site scripting in Topic Tree and JSON tree tooltips
Summary
MQTTX Desktop, an open-source MQTT client from EMQ, renders MQTT topic names and payloads unescaped in tooltips of the Topic Tree and JSON tree. An attacker who controls a broker or can publish to a subscribed topic can inject script that runs in the Electron renderer, which has Node integration enabled. The script runs when a user hovers over an affected node, so user interaction is required and the attacker may gain the user's privileges on the workstation.
Affected
- MQTTX Desktop 0 through 1.13.3 (according to the CVE record)
Fixed in
Unknown. No vendor advisory names a patched version for CVE-2026-126495. The v1.13.1 release notes list a fix for escaping MQTT topic and payload rendering, but the sources do not confirm that it covers the tooltip paths.
Workaround
- Use MQTTX only with brokers you trust
- Limit who can publish to topics that your team subscribes to
- Avoid hovering over tree nodes from unknown sources
- Clear stored sessions and data that are no longer needed
Exploitation
- Not listed in CISA KEV
- No public exploit code has been confirmed
- No evidence of exploitation in the wild has been found
Our recommendation
- Inventory all MQTTX Desktop and CLI installations and record their versions
- Update to the newest release and check the vendor release notes or the GitHub issue for confirmation that the tooltip paths are fixed
- Until a fix is confirmed, restrict subscriptions to trusted brokers and topics, and do not use MQTTX on workstations that hold broker credentials for critical systems
- Monitor the EMQ GitHub issue and release notes for a dedicated advisory
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- CVE record CVE-2026-126495 www.cve.org
- EMQ GitHub issue 2180 github.com
- MQTTX GitHub repository github.com
- MQTTX releases github.com
- MQTTX v1.13.1 release github.com
- MQTTX changelog v1.13.1 mqttx.app
- VulDB CVE-2026-126495 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:14.
Original description (NVD)
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subscribed topics can execute script in the Electron renderer, which has nodeIntegration enabled, when victims hover Topic Tree or JSON tree nodes.
NVD references (6)
- https://github.com/emqx/MQTTX
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/background.ts#L276-L283
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/JSONViewer.vue#L175-L184
- https://github.com/emqx/MQTTX/blob/v1.13.3/src/widgets/TreeView.vue#L195-L226
- https://github.com/emqx/MQTTX/issues/2180
- https://www.vulncheck.com/advisories/mqttx-through-1.13.3-stored-xss-via-topic-tree-and-json-tree-tooltips
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.