CVE-2026-71279
8 HIGHpublic exploit availablePublished 2026-08-05 · Updated 2026-08-10
AI risk analysis
- Summary
- The flaw allows an attacker to execute arbitrary code by manipulating the file path in an MQTT message, leading to remote code execution.
- Exploitability
- Exploitation is relatively easy given the lack of input validation, and requires an attacker to send a crafted MQTT message to the Zigbee2MQTT bridge.
- Blast radius
- If exploited, the impact could be severe, potentially allowing full control over the system running Zigbee2MQTT.
- Detection
- No reliable host or network indicator is derivable from the published description.
- Prioritized remediation
- Upgrade to Zigbee2MQTT 2.590 or later, which includes input validation to prevent this vulnerability.
rcemqttcode-execution
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Public exploit & PoC references
References
Data: NVD (public domain). Analysis: local $0 model. Defensive use only.