PT-2026-59271 · Pypi · Malla

Publicado 2026-07-13 · Atualizado 2026-07-13

OSV

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Node names (long name, short name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.

Affected files:

• src/malla/templates/traceroute graph.html (line ~832)
• src/malla/templates/map.html (lines ~945, 1078)
• src/malla/templates/packet detail.html (lines ~1402, 1452)
• src/malla/static/js/relay node analysis.js (line ~124)

Steps to reproduce

1. Publish a Meshtastic NODEINFO APP packet to any public MQTT broker with long name set to a HTML entity i.e <img src=x onerror=alert(1)>
2. Wait for malla-capture to store it
3. Open the dashboard

Impact

Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as:

• Phishing overlays
• Force redirect to malicious websites
• Injection of arbitrary third-party scripts (no CSP restrictions)
• Browser resource abuse
• Persistent dashboard denial of service

Correção

Identificadores relacionados

PYSEC-2026-2618

Produtos afetados

Malla

Referências · 7

• https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135 · Nota
• https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm · Nota
• https://github.com/zenitraM/malla · Nota
• https://github.com/advisories/GHSA-ch57-39q2-4crm · Nota
• https://pypi.org/project/malla · Nota
• https://osv.dev/vulnerability/PYSEC-2026-2618 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-43980 · Nota de Segurança