{"id":"CVE-2026-43980","aliases":["EUVD-2026-64171","GHSA-ch57-39q2-4crm","PYSEC-2026-2618"],"status":"published","title":"Malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00325,"percentile":0.25789,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-06-03T21:06:27Z","modified":"2026-11-11T02:49:00Z","affected":[{"source":"ghsa","ecosystem":"PyPI","package":"malla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.7"}]}]},{"source":"osv","ecosystem":"PyPI","package":"malla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.7"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7"]},{"source":"osv","ecosystem":"PyPI","package":"malla","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.1.7"}]}],"versions":["0.1.0","0.1.1","0.1.2","0.1.3","0.1.4","0.1.5","0.1.6","0.1.7"]}],"products":[{"vendor":"zenitram","product":"malla"}],"references":[{"url":"https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm","tags":["x_refsource_CONFIRM","exploit","advisory","web"]},{"url":"https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/malla/PYSEC-2026-2618.yaml","tags":["x_refsource_MISC","advisory"]},{"url":"https://github.com/advisories/GHSA-ch57-39q2-4crm","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43980.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-43980","tags":["advisory"]},{"url":"https://github.com/zenitraM/malla","tags":["package"]},{"url":"https://pypi.org/project/malla","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-43980","title":"Malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.","status":"published","published":"2026-08-21T21:17:45.43Z","modified":"2026-08-24T20:10:33.215Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T13:37:25.103021Z"}],"euvd":[{"id":"EUVD-2026-64171","description":"Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.","status":"published","published":"2026-08-21T21:17:45Z","modified":"2026-08-24T20:10:33Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:01:33.760029Z"}],"ghsa":[{"id":"GHSA-ch57-39q2-4crm","title":"malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping.\nAny participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.\n\nAffected files:\n\n - src/malla/templates/traceroute_graph.html (line ~832)\n - src/malla/templates/map.html (lines ~945, 1078)\n - src/malla/templates/packet_detail.html (lines ~1402, 1452)\n - src/malla/static/js/relay_node_analysis.js (line ~124)\n\nSteps to reproduce\n\n 1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `\u003cimg src=x onerror=alert(1)\u003e`\n 2. Wait for malla-capture to store it\n 3. Open the dashboard\n\nImpact\n\nAllows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as: \n\n - Phishing overlays\n - Force redirect to malicious websites\n - Injection of arbitrary third-party scripts (no CSP restrictions)\n - Browser resource abuse \n - Persistent dashboard denial of service","status":"published","published":"2026-06-03T21:06:27Z","modified":"2026-06-03T21:06:28Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:40:16.698699Z"}],"nvd":[{"id":"CVE-2026-43980","description":"Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.","status":"published","published":"2026-08-21T22:16:37.563Z","modified":"2026-10-12T16:10:00.22Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:12:40.665005Z"}],"osv":[{"id":"CVE-2026-43980","title":"Malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.","status":"published","published":"2026-08-21T21:17:45.43Z","modified":"2026-11-11T02:49:00.171136754Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T03:21:28.618498Z"},{"id":"GHSA-ch57-39q2-4crm","title":"malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping.\nAny participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.\n\nAffected files:\n\n - src/malla/templates/traceroute_graph.html (line ~832)\n - src/malla/templates/map.html (lines ~945, 1078)\n - src/malla/templates/packet_detail.html (lines ~1402, 1452)\n - src/malla/static/js/relay_node_analysis.js (line ~124)\n\nSteps to reproduce\n\n 1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `\u003cimg src=x onerror=alert(1)\u003e`\n 2. Wait for malla-capture to store it\n 3. Open the dashboard\n\nImpact\n\nAllows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as: \n\n - Phishing overlays\n - Force redirect to malicious websites\n - Injection of arbitrary third-party scripts (no CSP restrictions)\n - Browser resource abuse \n - Persistent dashboard denial of service","status":"published","published":"2026-06-03T21:06:27Z","modified":"2026-07-13T16:42:34.586982995Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"PYSEC-2026-2618","title":"malla: Stored XSS via Meshtastic node names in multiple frontend pages","description":"Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping.\nAny participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.\n\nAffected files:\n\n - src/malla/templates/traceroute_graph.html (line ~832)\n - src/malla/templates/map.html (lines ~945, 1078)\n - src/malla/templates/packet_detail.html (lines ~1402, 1452)\n - src/malla/static/js/relay_node_analysis.js (line ~124)\n\nSteps to reproduce\n\n 1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `\u003cimg src=x onerror=alert(1)\u003e`\n 2. Wait for malla-capture to store it\n 3. Open the dashboard\n\nImpact\n\nAllows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as: \n\n - Phishing overlays\n - Force redirect to malicious websites\n - Injection of arbitrary third-party scripts (no CSP restrictions)\n - Browser resource abuse \n - Persistent dashboard denial of service","status":"published","published":"2026-07-13T15:46:14.341406Z","modified":"2026-07-13T16:32:12.450350554Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:52:55.961245Z"}]}}