CVE-2026-43980

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-43980

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43980.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-43980

Aliases

Published

2026-08-21T21:17:45.430Z

Modified

2026-08-25T03:51:44.279410053Z

Severity

6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

Malla: Stored XSS via Meshtastic node names in multiple frontend pages

Details

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (longname, shortname) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

Database specific

{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4086e2b5f61615a813b70b25bc76095083552135"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43980.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/zenitram/malla

Affected ranges

Type

GIT

Repo

https://github.com/zenitram/malla

Events

Introduced

Fixed

4086e2b5f61615a813b70b25bc76095083552135

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43980.json"