CVE-2026-43980

Published: Ago 22, 2026 Last Modified: Ago 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:
MEDIUM 6,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: none
User Interaction: required
Scope: unchanged
Confidentiality: low
Integrity: low
Availability: low

Description

AI Translation Available

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Stable
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Access Control Confidentiality Integrity Availability
Potential Impacts:
Bypass Protection Mechanism Read Application Data Execute Unauthorized Code Or Commands
Applicable Platforms
Technologies: AI/ML, Web Based, Web Server
Likelihood of Exploit: High
View CWE Details
https://github.com/pypa/advisory-database/tree/main/vulns/m…
https://github.com/pypa/advisory-database/tree/main/vulns/malla/PYSEC-2026-2618…
https://github.com/zenitraM/malla/commit/4086e2b5f61615a813…
https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc760950835521…
https://github.com/zenitraM/malla/security/advisories/GHSA-…
https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm