{"id":"CVE-2026-71279","published":"2026-08-05T13:24:52.437","lastModified":"2026-08-10T12:17:30.457","description":"Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.","cvssScore":8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-22"],"vendors":[],"products":[],"references":[{"url":"https://github.com/Koenkk/zigbee2mqtt","tags":[]},{"url":"https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts","tags":[]}],"exploitRefs":[{"url":"https://github.com/Koenkk/zigbee2mqtt","tags":[]},{"url":"https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an attacker to execute arbitrary code by manipulating the file path in an MQTT message, leading to remote code execution.","exploitability":"Exploitation is relatively easy given the lack of input validation, and requires an attacker to send a crafted MQTT message to the Zigbee2MQTT bridge.","blast_radius":"If exploited, the impact could be severe, potentially allowing full control over the system running Zigbee2MQTT.","remediation":"Upgrade to Zigbee2MQTT 2.590 or later, which includes input validation to prevent this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","mqtt","code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-06T08:46:06.987Z"}}