Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted. Technical Details Additional unescaped agent fields: - node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) -- HIGH - cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM - volumes[].name unescaped in file browser (line 12612) -- MEDIUM No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only…
Recommended action: Upgrade to 1.1.60 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
We have identified a cross-site websocket hijacking (CSWSH) vulnerability within the control.ashx endpoint of MeshCentral. This component is the primary mechanism used within MeshCentral to perform administrative actions on the server. To demonstrate the impact of the vulnerability we developed a proof-of-concept which leveraged the cross-site websocket hijacking vulnerability to read the server configuration file to leak the sessionKey variable, generating login tokens, and generating an authentication cookie. The vulnerability is exploitable when an attacker is able to convince a victim end-user to click on a malicious link to a page hosting an attacker-controlled site. The attacker can then originate a cross-site websocket connection using client-side JavaScript code to connect to “control.ashx” as the victim user within MeshCentral. There are some caveats to exploiting this issue however as MeshCentral configures SameSite=Lax security setting on cookies which introduces some…
Recommended action: Upgrade to 1.1.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.
Recommended action: Upgrade to 1.1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.