PT-2025-29170 · Unknown · Meshtastic

Yaniv-Git · Published 2025-07-10 · Updated 2025-07-11 · CVE-2025-53637

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Meshtastic versions prior to 2.6.6

Description: Meshtastic is an open source mesh networking solution. The main matrix.yml GitHub Action is triggered by the pull request target event, which has extensive permissions and can be initiated by an attacker who has forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If exploited, attackers could inject unauthorized code into the repository.

Recommendations: Update to version 2.6.6 or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-53637

GHSA-6MWM-V2VV-PP96

Affected Products

Meshtastic

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53637.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53637 · Security Note
• https://github.com/meshtastic/firmware/blob/3fd47d9713e7d1b6866c48cf218e2435741651a2/.github/workflows/main_matrix.yml#L34-L41 · Note
• https://github.com/meshtastic/firmware/security/advisories/GHSA-6mwm-v2vv-pp96 · Note
• https://twitter.com/CVEnew/status/1943668178346967471 · Twitter Post
• https://t.me/cvenotify/128466 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1943584332125196514 · Twitter Post