{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/meshcentral--1.1.60/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["MeshCentral (\u003c 1.1.60)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["MeshCentral"],"content_html":"\u003cp\u003eMeshCentral versions prior to 1.1.60 contain multiple stored XSS vulnerabilities stemming from the lack of server-side sanitization for data transmitted by MeshAgents. Specifically, the 'osdesc' (Operating System description), 'node.name', and several other fields received from agents are processed and stored by the server without being scrubbed for malicious HTML or JavaScript. When an administrator views these fields in the device management UI, the application renders the raw content using innerHTML, triggering execution of the payload. Because the MeshCentral management UI's Content Security Policy (CSP) explicitly allows 'unsafe-inline' scripts, an attacker can bypass traditional script restrictions. This vulnerability allows a compromised or rogue MeshAgent to achieve full control over an administrator's browser session, facilitating actions such as cookie theft, unauthorized device management, or command execution within the context of the admin account.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker compromises an existing MeshAgent or deploys a rogue MeshAgent instance.\u003c/li\u003e\n\u003cli\u003eThe attacker establishes a WebSocket connection to the MeshCentral server.\u003c/li\u003e\n\u003cli\u003eThe attacker transmits a malicious 'coreinfo' JSON payload to the server containing a crafted string in the 'osdesc' or 'node.name' field.\u003c/li\u003e\n\u003cli\u003eThe MeshCentral server receives the message, performs only basic type validation (typeof == 'string'), and commits the malicious string to the database.\u003c/li\u003e\n\u003cli\u003eAn administrator logs into the MeshCentral management interface and navigates to the device details or sharing panels.\u003c/li\u003e\n\u003cli\u003eThe server fetches the malicious data from the database and sends it to the admin's browser as part of the UI response.\u003c/li\u003e\n\u003cli\u003eThe browser renders the data via an internal function that sets the 'innerHTML' property, forcing the execution of the injected script.\u003c/li\u003e\n\u003cli\u003eThe script executes within the admin's session, enabling exfiltration of cookies or unauthorized administrative operations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in Stored XSS in the MeshCentral administrative dashboard. This provides an attacker with the ability to perform any action the administrator can execute, including stealing session cookies, modifying server configuration, and gaining control over all connected agents. The impact is significant for organizations managing large fleets of devices through MeshCentral.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade MeshCentral to version 1.1.60 or later immediately to patch the sanitization logic.\u003c/li\u003e\n\u003cli\u003eReview the MeshCentral management UI's Content Security Policy (CSP) to restrict or remove 'unsafe-inline' if consistent with organizational security posture.\u003c/li\u003e\n\u003cli\u003eInspect MeshCentral server-side logs for unexpected 'coreinfo' WebSocket messages containing HTML or script-related characters.\u003c/li\u003e\n\u003cli\u003eMonitor administrative sessions for anomalous API calls originating from the MeshCentral dashboard that do not correlate with legitimate administrative activity.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-18T20:57:45Z","date_published":"2026-08-18T20:57:45Z","id":"https://feed.craftedsignal.io/briefs/2026-08-meshcentral-xss/","summary":"MeshCentral versions prior to 1.1.60 are vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of data fields sent from MeshAgents, allowing attackers to execute arbitrary JavaScript in administrative browser sessions.","title":"Stored XSS Vulnerabilities in MeshCentral via MeshAgent Data Fields","url":"https://feed.craftedsignal.io/briefs/2026-08-meshcentral-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - MeshCentral (\u003c 1.1.60)","version":"https://jsonfeed.org/version/1.1"}