CVE-2026-43980

Received Received - Intake

Stored XSS in Malla Web Analyzer for Meshtastic Networks

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-21

Last Modified

2026-08-21

Generated

2026-08-22

AI Q&A

2026-08-22

EPSS Evaluated

N/A

NVD

CVE-2026-43980

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Malla, a web analyzer for Meshtastic networks. It occurs because node names received via MQTT are stored in SQLite without sanitization and then rendered into the DOM without escaping. This allows attackers to inject malicious JavaScript code via node names on a public Meshtastic MQTT broker.

Detection Guidance

Check if your Malla instance is running a vulnerable version (before commit 4086e2b5f61615a813b70b25bc76095083552135). Inspect MQTT messages for node names containing JavaScript or HTML tags. Monitor browser console logs for unexpected script executions when viewing the dashboard.

Impact Analysis

If you use Malla to analyze Meshtastic networks, an attacker could set a malicious node name that executes arbitrary JavaScript in your browser when you view the dashboard. This could lead to session hijacking, data theft, or unauthorized actions on your behalf.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Organizations using Malla may face compliance risks if user data is compromised due to this flaw.

Mitigation Strategies

Update Malla to the latest commit (4086e2b5f61615a813b70b25bc76095083552135) or newer. If immediate update is not possible, restrict access to the MQTT broker to trusted participants only. Sanitize node names in the dashboard code to prevent XSS attacks.

Hi! I’m here to help you understand CVE-2026-43980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70