EUVD-2026-53364
GHSA-77vh-g47p-vh46
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Adjacent vector and low privileges reflect MQTT broker publish access; full CIA follows from arbitrary code execution in the application process.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
Zigbee2MQTT's ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts) joins a name parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. Because path.join() resolves ../ sequences, a name such as ../../tmp/evil.js escapes the intended extensions directory. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import(), achieving remote code execution. Requires the enable_external_js config option (off by default, but commonly enabled in legacy installs) and MQTT broker access, which is frequently unauthenticated in real deployments. The identical unsanitized getFilePath() is also used by the extension-removal handler, enabling arbitrary file deletion.
Articles & Coverage 1
AnalysisAI
Remote code execution and arbitrary file deletion in Zigbee2MQTT stem from an unsanitized path.join() call in ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts), allowing any MQTT client with publish access to escape the extensions directory via traversal sequences and write arbitrary files to the host filesystem. Once the malicious .js file is written, Zigbee2MQTT immediately imports it via Node.js import(), executing attacker-controlled code in the application process context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two conditions must both be met: (1) enable_external_js must be set to true in the Zigbee2MQTT configuration - this option defaults to false, meaning default-configured deployments are not reachable through this code path, but the description explicitly characterizes it as commonly enabled in legacy installations; (2) the attacker must have publish access to the MQTT broker on topic zigbee2mqtt/bridge/request/extension/save - CVSS AV:A/PR:L reflects adjacent-network low-privilege access, but the description states that real-world Zigbee2MQTT MQTT brokers are frequently unauthenticated, effectively making this condition trivially satisfiable in a large fraction of deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.0 base score (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) correctly reflects the adjacent-network requirement: the attacker must publish to the MQTT broker, which is nominally a PR:L condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version was confirmed from the provided references at time of analysis; operators should monitor the Zigbee2MQTT GitHub repository at https://github.com/Koenkk/zigbee2mqtt for an official fix and upgrade immediately upon release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Zigbee2MQTT deployments and audit MQTT broker configuration to restrict publish access to authenticated, trusted clients only; immediately implement network segmentation to prevent untrusted clients from reaching MQTT brokers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today