PYSEC-2026-2618

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/malla/PYSEC-2026-2618.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-2618
Aliases
Published
2026-07-13T15:46:14.341406Z
Modified
2026-07-13T16:32:12.450350554Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
malla: Stored XSS via Meshtastic node names in multiple frontend pages
Details

Node names (longname, shortname) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.

Affected files:

  • src/malla/templates/traceroute_graph.html (line ~832)
  • src/malla/templates/map.html (lines ~945, 1078)
  • src/malla/templates/packet_detail.html (lines ~1402, 1452)
  • src/malla/static/js/relaynodeanalysis.js (line ~124)

Steps to reproduce

  1. Publish a Meshtastic NODEINFOAPP packet to any public MQTT broker with longname set to a HTML entity i.e <img src=x onerror=alert(1)>
  2. Wait for malla-capture to store it
  3. Open the dashboard

Impact

Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as:

  • Phishing overlays
  • Force redirect to malicious websites
  • Injection of arbitrary third-party scripts (no CSP restrictions)
  • Browser resource abuse
  • Persistent dashboard denial of service
References

Affected packages

PyPI / malla

Package

Name
malla
View open source insights on deps.dev
Purl
pkg:pypi/malla

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
0.1.7

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/malla/PYSEC-2026-2618.yaml"