Vulnerability · Published Aug 21, 2026 · Assigned by GitHub_M

CVE-2026-43980Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Medium 6.3

In plain English

A medium-severity cross-site scripting in malla from zenitraM. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.3%top 74.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	malla	no fix listed	GHSA-ch57-39q2-4crm
PyPI	malla	no fix listed	PYSEC-2026-2618

Affected products (as reported)

Vendor	Product	Versions
zenitraM	malla	< 4086e2b5f61615a813b70b25bc76095083552135

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References

https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm x_refsource_CONFIRM
https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135 x_refsource_MISC
https://github.com/pypa/advisory-database/tree/main/vulns/malla/PYSEC-2026-2618.yaml x_refsource_MISC