CyberRota Analysis
AI-GeneratedZigbee2MQTT is vulnerable due to improper sanitization of the `name` parameter in the ExternalJSExtension.getFilePath() function, allowing attackers to exploit path traversal and execute arbitrary JavaScript code via remote code execution. This vulnerability can also lead to arbitrary file deletion through the extension-removal handler, particularly if the `enable_external_js` configuration option is enabled, which is common in legacy installations. Organizations using Zigbee2MQTT, especially those with MQTT broker access configured without authentication, should prioritize addressing this high-severity vulnerability to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution.