CVE-2025-62413: MQTTX Desktop Client XSS Vulnerability

CVE-2025-62413 Overview

MQTTX is an MQTT 5.0 desktop client and testing tool developed by EMQX. CVE-2025-62413 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] introduced in MQTTX v1.12.0. The flaw stems from improper handling of MQTT message payload rendering in the message viewer. Malicious payloads containing HTML or JavaScript are rendered directly by the client, allowing attackers to execute arbitrary scripts in the context of the application UI. The vulnerability is fixed in version 1.12.1.

Critical Impact
Attackers who control MQTT broker messages can inject scripts that access MQTT connection credentials or trigger unintended actions within the MQTTX client UI.

Affected Products

MQTTX Desktop Client v1.12.0
EMQX MQTTX prior to 1.12.1
Deployments connecting to untrusted or multi-tenant MQTT brokers

Discovery Timeline

2025-10-16 - CVE-2025-62413 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62413

Vulnerability Analysis

The vulnerability resides in the MQTTX message viewer component. MQTT payloads are text or binary blobs that clients typically render for inspection. In MQTTX v1.12.0, the viewer renders payload content without sanitizing embedded HTML or JavaScript. When a subscriber views a malicious message, the client executes any script tags or inline event handlers contained in the payload.

This attack requires user interaction, since the victim must open or view the malicious message in the MQTTX UI. The scope is changed because the injected script runs in the trusted Electron/browser context of the desktop client, outside the MQTT protocol boundary. Successful exploitation can expose stored connection profiles, broker credentials, and topic subscriptions.

Root Cause

The root cause is missing output encoding in the payload rendering pipeline. The MQTTX viewer treats message payloads as trusted display content instead of untrusted input requiring HTML escaping. Because MQTT brokers relay arbitrary bytes from any authorized publisher, any client that renders payloads as HTML inherits publisher trust from the broker. The fix in v1.12.1 adds structured format handling, including an isXML detector and an escapeXmlForHtml helper that neutralizes markup characters before rendering.

Attack Vector

An attacker with publish rights on a topic that a MQTTX user subscribes to can send a crafted payload containing HTML or JavaScript. Multi-tenant brokers, public test brokers, and shared development environments are the most exposed scenarios. When the target views the message, the payload executes in the client context.

typescript

// Patch excerpt: src/utils/xmlUtils.ts adds structured detection and escaping
export const isXML = (str: string): boolean => {
  if (!str || typeof str !== 'string') {
    return false
  }

  const trimmed = str.trim()

  // Check basic XML structure
  if (!trimmed.startsWith('<') || !trimmed.endsWith('>')) {
    return false
  }

  // Check for XML declaration
  if (trimmed.startsWith('<?xml')) {
    return true
  }

  const xmlPattern =
    /^(<!--[\s\S]*?-->)*<([^\/\s>!]+)(?:\s[^>]*)?>[\s\S]*?<\/\2>$|^(<!--[\s\S]*?-->)*<[^\/\s>!]+(?:\s[^>]*)?\/?>$/

  return xmlPattern.test(trimmed)
}

export const escapeXmlForHtml = (str: string): string => {
  if (!str || typeof str !== 'string') {
    return str
  }
  // Escaping logic continues in patch
}
// Source: https://github.com/emqx/MQTTX/commit/2963f78a4b3227cdb93597f546a75b75dee1059f

Detection Methods for CVE-2025-62413

Indicators of Compromise

MQTT messages containing <script> tags, inline on* event handlers, or javascript: URIs in payload bodies.
Outbound network requests from MQTTX processes to unexpected domains shortly after message viewing.
Unexplained modifications to stored MQTTX connection profiles or exported credentials.

Detection Strategies

Inspect broker logs for published payloads matching HTML or JavaScript patterns on topics consumed by developer or operations users.
Monitor endpoints running MQTTX for anomalous child processes or file writes originating from the Electron renderer.
Track installed MQTTX versions across the fleet and flag any host still running v1.12.0.

Monitoring Recommendations

Enable payload logging on brokers that serve MQTTX clients and alert on script-like content.
Correlate MQTTX process activity with credential store access to catch post-exploitation theft.
Audit broker ACLs to identify publishers that can reach topics viewed by MQTTX operators.

How to Mitigate CVE-2025-62413

Immediate Actions Required

Upgrade all MQTTX installations to version 1.12.1 or later.
Rotate MQTT broker credentials that were stored in MQTTX clients running v1.12.0.
Restrict MQTTX use against untrusted or public brokers until upgrades complete.

Patch Information

The fix is available in MQTTX v1.12.1. Details are documented in the GitHub Security Advisory GHSA-29gf-9r9v-j4m3 and the GitHub Commit Update. The patch introduces structured payload format handling and HTML escaping utilities in src/utils/xmlUtils.ts.

Workarounds

Only subscribe to topics on trusted brokers where publisher identities are verified.
Tighten broker ACLs so untrusted principals cannot publish to topics viewed by MQTTX users.
Avoid opening messages from unknown publishers in the MQTTX viewer until patched.

bash

# Verify installed MQTTX version on Linux/macOS
mqttx --version

# Upgrade via package managers or download 1.12.1+ from the official release page
# Example (Homebrew):
brew upgrade mqttx