CVE-2026-71279 Details
Description
Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.
A remote code execution vulnerability exists in Zigbee2MQTT versions prior to 2.13.0. The issue arises in the ExternalJSExtension.getFilePath() method, where a 'name' parameter received via an MQTT message is improperly sanitized before being joined into the extensions base path. This lack of validation allows for directory traversal, enabling an attacker to escape the intended directory and execute arbitrary JavaScript code. The vulnerability requires the 'enable_external_js' configuration option, which is off by default but often enabled in legacy installations, and access to an MQTT broker, which is frequently unauthenticated in real-world deployments.
Users can update to Zigbee2MQTT version 2.13.0 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 5, 2026CISA-ADP
Assessed Aug 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Koenkk/zigbee2mqtt | TuranSec | Vendor |
| https://github.com/Koenkk/zigbee2mqtt/blob/master/lib/extension/externalJS.ts | TuranSec | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | TuranSec |
Affected Products
| Product | Versions |
|---|---|
| Zigbee2MQTT | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | TuranSec |
| Aug 5, 2026 | CVE Modified | CISA-ADP |
| Aug 5, 2026 | New CVE Received | TuranSec |