CVE-2026-43980 Malla: Stored XSS via Meshtastic node names in multiple frontend pages
Attackers can inject malicious JavaScript via Meshtastic node names, executing code in the browsers of Malla dashboard visitors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-43980?
CVE-2026-43980 is a medium-severity cross-site scripting vulnerability in zenitraM malla, published on 21 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-43980?
3 open source packages ship an affected version, including malla.
| Package | Affected | Fixed in |
|---|---|---|
malla PyPI | All versions to 0.1.7 | None |
malla PyPI | All versions to 0.1.7 | None |
malla PyPI | All versions to 0.1.7 | None |
How do I fix CVE-2026-43980?
No fix has been published for CVE-2026-43980 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-43980 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43980 exists.
Sources
Also known as GHSA-ch57-39q2-4crm, PYSEC-2026-2618.