PT-2026-46117 · Malla · Malla

CVE-2026-43980 · Published 2026-06-03 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Malla (affected versions not specified)

Description Node names received via MQTT are stored in SQLite without sanitization and rendered into the Document Object Model (DOM) without escaping. This allows unauthenticated remote attackers to set malicious node names via a public Meshtastic MQTT broker, leading to the execution of arbitrary JavaScript in the browser of any Malla dashboard visitor. The issue involves the long name and short name variables. Potential impacts include phishing overlays, forced redirects to malicious websites, injection of third-party scripts, browser resource abuse, and persistent dashboard denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-43980

GHSA-CH57-39Q2-4CRM

PYSEC-2026-2618

Affected Products

Malla

References · 8

• https://osv.dev/vulnerability/PYSEC-2026-2618 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-43980 · Security Note
• https://osv.dev/vulnerability/GHSA-ch57-39q2-4crm · Vendor Advisory
• https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135 · Note
• https://github.com/zenitraM/malla · Note
• https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm · Note
• https://pypi.org/project/malla · Note
• https://github.com/advisories/GHSA-ch57-39q2-4crm · Note