malla: Stored XSS via Meshtastic node names in multiple frontend pages
Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.
Affected files:
- src/malla/templates/traceroute_graph.html (line ~832)
- src/malla/templates/map.html (lines ~945, 1078)
- src/malla/templates/packet_detail.html (lines ~1402, 1452)
- src/malla/static/js/relay_node_analysis.js (line ~124)
Steps to reproduce
- Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e
<img src=x onerror=alert(1)> - Wait for malla-capture to store it
- Open the dashboard
Impact
Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as:
- Phishing overlays
- Force redirect to malicious websites
- Injection of arbitrary third-party scripts (no CSP restrictions)
- Browser resource abuse
- Persistent dashboard denial of service
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | malla | <= 0.1.7 | no fix |
References
- https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm
- https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135
- https://github.com/zenitraM/malla
- https://pypi.org/project/malla
- https://github.com/advisories/GHSA-ch57-39q2-4crm
- https://nvd.nist.gov/vuln/detail/CVE-2026-43980
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L- Weakness (CWE)
CWE-79- Platform
- Python (PyPI)
- Package
malla- Disclosed
- 03.06.2026
- Updated
- 11.10.2026 14:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-2618 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-ch57-39q2-4crm - CC BY 4.0
Vulnerability history: malla
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.