CVE-2025-53637 Meshtastic allows Command Injection in GitHub Action

What is CVE-2025-53637?

CVE-2025-53637 is a medium-severity command injection vulnerability in meshtastic firmware, published on 10 Jul 2025. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6.

Weakness: CWE-78

Which versions are affected by CVE-2025-53637?

It affects 1 product.

Products include Meshtastic Meshtastic Firmware.

How do I fix CVE-2025-53637?

No fix has been published for CVE-2025-53637 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2025-53637 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-53637 exists.

Other vulnerabilities in meshtastic firmware

• CVE-2025-52464 Meshtastic Repeated Public and Private Keypairs Critical 9.5
• CVE-2025-55293 Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB Critical 9.4
• CVE-2025-24797 Meshtastic incorrectly hands malformed packets leads to controlled buffer overflow Critical 9.4
• CVE-2025-55292 In Meshtastic, an attacker can spoof licensed amateur flag for a node High 8.2
• CVE-2024-47078 Meshtastic firmware Authentication/Authorization Bypass via MQTT High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6mwm-v2vv-pp96.