CVE-2026-126495

Name of the Vulnerable Software and Affected Versions MQTTX desktop versions prior to 1.13.4

Description A stored cross-site scripting issue exists where attackers can inject scripts by publishing malicious MQTT topic names or payloads. These scripts are rendered unescaped in tooltips. An attacker controlling a broker or publishing to subscribed topics can execute scripts in the Electron renderer, which has nodeIntegration enabled, when a user hovers over Topic Tree or JSON tree nodes.

Recommendations Update MQTTX desktop to version 1.13.4 or later.