Prior to version 0.3.3, MeshCore Card does not escape node names when rendering the Lovelace card. This omission allows injected HTML or JavaScript to run in the Home Assistant frontend of anyone who views the card. An attacker controlling a MeshCore node that is either directly or indirectly within radio range can place a malicious node name that executes arbitrary client‑side code, enabling session hijacking, data theft, or further client‑side attacks within the user’s Home Assistant interface.

This vulnerability affects the MeshCore Card component from the vendor jpettitt under the product name meshcore‑card. All releases before 0.3.3 are impacted; the fix is available starting with version 0.3.3.

The flaw carries a CVSS score of 9.6, indicating high severity. While the EPSS score is not available, the nature of the defect—client‑side script injection—means that compromised nodes can affect every user who can view the card. The threat originates from a local wireless network but can reach any Home Assistant user, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the potential impact and ease of exploitation make remediation urgent.