---
id: CVE-2025-62413
title: MQTTX is an MQTT 5.0 desktop client and MQTT testing tool
summary: >-
  MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site
  Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper
  handling of MQTT message payload rendering. Malicious payloads containing HTML
  or JavaS…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2025-10-16'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T10:10:00.193'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-62413'
references:
  - url: >-
      https://github.com/emqx/MQTTX/commit/2963f78a4b3227cdb93597f546a75b75dee1059f
    label: security-advisories@github.com
  - url: 'https://github.com/emqx/MQTTX/security/advisories/GHSA-29gf-9r9v-j4m3'
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00325
epssPercentile: 0.23524
ingestedAt: '2026-10-09T12:53:29.052Z'
---

## Overview

MQTTX is an MQTT 5.0 desktop client and MQTT testing tool. A Cross-Site Scripting (XSS) vulnerability was introduced in MQTTX v1.12.0 due to improper handling of MQTT message payload rendering. Malicious payloads containing HTML or JavaScript could be rendered directly in the MQTTX message viewer. If exploited, this could allow attackers to execute arbitrary scripts in the context of the application UI — for example, attempting to access MQTT connection credentials or trigger unintended actions through script injection. This vulnerability is especially relevant when MQTTX is used with brokers in untrusted or multi-tenant environments, where message content cannot be fully controlled. This vulnerability is fixed in 1.12.1.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.