CVE-2025-62413

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-16

Last updated on: 2025-10-21

Assigner: GitHub, Inc.

Description

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-16

Last Modified

2025-10-21

Generated

2026-07-06

AI Q&A

2025-10-16

EPSS Evaluated

2026-07-05

NVD

CVE-2025-62413

EUVD

EUVD-2025-34812

Affected Vendors & Products

Vendor	Product	Version / Range
emqx	mqttx	1.12.0
emqx	mqttx	1.12.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross-Site Scripting (XSS) issue in MQTTX version 1.12.0. It occurs because the application improperly handles the rendering of MQTT message payloads, allowing malicious HTML or JavaScript code within messages to be executed in the application's user interface. This can let attackers run arbitrary scripts, potentially accessing sensitive information or triggering unintended actions.

Impact Analysis

If exploited, this vulnerability can allow attackers to execute arbitrary scripts within the MQTTX application UI. This could lead to unauthorized access to MQTT connection credentials or cause unintended actions to be performed. The risk is higher when MQTTX is used with brokers in untrusted or multi-tenant environments where message content is not fully controlled.

Mitigation Strategies

Upgrade MQTTX to version 1.12.1 or later, where the vulnerability is fixed. Additionally, avoid using MQTTX with brokers in untrusted or multi-tenant environments until the update is applied to reduce risk.

Hi! I’m here to help you understand CVE-2025-62413. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70