Read the docs
TI-2026-32024 Aliases CVE-2026-43980GHSA-ch57-39q2-4crm

Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Priority MEDIUM 61CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00325 25th percentileScored 2026-11-07
Fix Fixed malla (zenitraM): 4086e2b5f61615a813b70b25bc76095083552135

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
zenitraMmallabefore 4086e2b5f61615a813b70b25bc760950835521354086e2b5f61615a813b70b25bc76095083552135Patch availableCNA
—malla (PyPI)up to 0.1.7—No fix listedGHSA-ch57-39q2-4crm
  • malla VendorzenitraM Affected before 4086e2b5f61615a813b70b25bc76095083552135 Fixed in 4086e2b5f61615a813b70b25bc76095083552135 Patch available CNA
  • malla (PyPI) Vendor— Affected up to 0.1.7 Fixed in — No fix listed GHSA-ch57-39q2-4crm

Remediation

  • Fix · CNA malla (zenitraM) Fixed in 4086e2b5f61615a813b70b25bc76095083552135

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-43980
  2. 2026-10-03 Alias added: GHSA-ch57-39q2-4crm

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences