CVE-2026-126495 is a stored cross-site scripting flaw in MQTTX desktop (through version 1.13.3) caused by topic names and payloads that get displayed without escaping inside tooltips. An attacker who controls a broker, or who can publish to a topic a victim has subscribed to, can run arbitrary script when that victim hovers over the Topic Tree or JSON tree — and because the app's Electron renderer has nodeIntegration enabled, that script can reach Node-level APIs.
// source: nvd.nist.gov ↗