Most recent entries from all

EUVD-2026-358375

2026-10-20T22:54:38.494386+00:00

EUVD-2026-358375

fkie_cve-2026-43980

2026-10-20T22:54:38.494417+00:00

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

GHSA-ch57-39q2-4crm — malla: Stored XSS via Meshtastic node names in multiple frontend pages

2026-10-20T22:54:38.494449+00:00

Affected: PyPI: malla

Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.

Affected files:

- src/malla/templates/traceroute_graph.html (line ~832) - src/malla/templates/map.html (lines ~945, 1078) - src/malla/templates/packet_detail.html (lines ~1402, 1452) - src/malla/static/js/relay_node_analysis.js (line ~124)

Steps to reproduce

1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `` 2. Wait for malla-capture to store it 3. Open the dashboard

Impact

Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as:

- Phishing overlays - Force redirect to malicious websites - Injection of arbitrary third-party scripts (no CSP restrictions) - Browser resource abuse - Persistent dashboard denial of service

PYSEC-2026-2618 — malla: Stored XSS via Meshtastic node names in multiple frontend pages