GitHub Advisoryadvisory · PyPI

GHSA-ch57-39q2-4crm malla: Stored XSS via Meshtastic node names in multiple frontend pages

MEDIUM Published 2026-06-03 Modified 2026-06-03 Official page ↗
Aliases
CVE-2026-43980
Ecosystem
PyPI
Packages
malla
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-79
Reviewed
2026-06-03

Affected packages

• PyPI malla: <= 0.1.7 (no fix yet)

Description

Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Affected files: • src/malla/templates/traceroute_graph.html (line ~832) • src/malla/templates/map.html (lines ~945, 1078) • src/malla/templates/packet_detail.html (lines ~1402, 1452) • src/malla/static/js/relay_node_analysis.js (line ~124) Steps to reproduce 1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `` 2. Wait for malla-capture to store it 3. Open the dashboard Impact Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as: • Phishing overlays • Force redirect to malicious websites • Injection of arbitrary third-party scripts (no CSP restrictions) • Browser resource abuse • Persistent dashboard denial of service

Related

Alias · CVE (1)

  • CVE-2026-43980 Malla is a web analyzer for Meshtastic networks based on MQTT data. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References