CVE-2026-43980: 
Python vulnerability analysis and mitigation

CVE-2026-43980 is a stored Cross-Site Scripting (XSS) vulnerability in Malla, a Meshtastic network dashboard tool. Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without HTML escaping, allowing any participant on a public Meshtastic MQTT broker to inject malicious JavaScript that executes in the browser of every Malla dashboard visitor. The vulnerability affects Malla versions ≤ 0.1.7 (pip package) and all commits up to and including c8a2ed3. It was published on May 30, 2026, and carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Malla Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). Meshtastic NODEINFO_APP packets carry node name fields (long_name, short_name) that are ingested by the malla-capture component and stored in a SQLite database without any input sanitization. These values are subsequently rendered directly into HTML templates and JavaScript files without output encoding, enabling stored XSS. Affected locations include src/malla/templates/traceroute_graph.html (~line 832), src/malla/templates/map.html (~lines 945, 1078), src/malla/templates/packet_detail.html (~lines 1402, 1452), and src/malla/static/js/relay_node_analysis.js (~line 124). No authentication or special privileges are required to publish a malicious MQTT packet to a public broker (GitHub Advisory, Malla Advisory).

Successful exploitation allows unauthenticated remote attackers to execute arbitrary JavaScript in the browsers of all Malla dashboard visitors who view pages containing the malicious node name. Potential consequences include phishing overlays, forced redirects to malicious websites, injection of arbitrary third-party scripts (with no Content Security Policy restrictions in place), browser resource abuse (e.g., cryptomining), and persistent dashboard denial of service. Confidentiality, integrity, and availability are all assessed as Low impact per CVSS, reflecting the browser-scoped nature of the attack rather than server-side compromise (GitHub Advisory).

No evidence of in-the-wild exploitation has been reported, and the CVE status remains "Reserved" with no CISA KEV catalog entry. The EPSS score is approximately 0.174% (39th percentile), indicating a low but non-negligible probability of exploitation within 30 days. The attack requires no authentication and has low complexity — any participant on a public Meshtastic MQTT broker can trigger it — making it accessible to low-skilled attackers. The vulnerability was reported by researcher tiagoabreu22 and a patch commit is publicly available, which could facilitate development of proof-of-concept exploits (GitHub Advisory, Malla Advisory).

1. Reconnaissance: Identify a public Meshtastic MQTT broker (e.g., mqtt.meshtastic.org) that is being monitored by a Malla dashboard instance running version ≤ 0.1.7.
2. Craft malicious payload: Prepare a Meshtastic NODEINFO_APP protobuf packet with the long_name or short_name field set to an XSS payload, such as <img src=x onerror=alert(document.cookie)> or a more sophisticated payload for session hijacking or redirection.
3. Publish to MQTT broker: Using a Meshtastic-compatible client or MQTT library (e.g., paho-mqtt in Python), publish the crafted NODEINFO_APP packet to the target public MQTT broker topic (e.g., msh/2/json/LongFast/!<node_id>).
4. Wait for ingestion: Allow malla-capture to receive and store the malicious node name in the SQLite database without sanitization.
5. Trigger victim execution: When any Malla dashboard visitor navigates to an affected page (traceroute graph, map, packet detail, or relay node analysis), the unsanitized node name is rendered into the DOM, executing the injected JavaScript in the visitor's browser.
6. Achieve objective: The executed script can exfiltrate session data, display phishing overlays, redirect users to attacker-controlled sites, or inject persistent malicious scripts (GitHub Advisory, Malla Advisory).

• Network: Outbound connections from dashboard visitor browsers to unexpected external domains following page load; MQTT traffic to public brokers containing node name fields with HTML/JavaScript special characters (<, >, script, onerror, etc.).
• Logs: Malla application or web server access logs showing requests to /traceroute_graph, /map, /packet_detail, or relay node analysis endpoints from multiple users in close succession (potential mass exploitation); SQLite database entries in the node name fields containing HTML tags or JavaScript event handlers.
• File System: SQLite database (malla.db or equivalent) containing records in node name columns with values including <script>, onerror=, javascript:, or similar XSS indicators.
• Browser: Unexpected JavaScript alerts, redirects, or network requests to third-party domains triggered upon loading Malla dashboard pages; browser developer console errors related to blocked or executed inline scripts.

The fix was introduced in commit 4086e2b5f61615a813b70b25bc76095083552135, which refactors frontend rendering to use safe DOM construction methods (el(), textNode(), replaceChildren()) instead of innerHTML assignments, preventing unsanitized data from being interpreted as HTML. A new dom.js utility module was added providing safe helpers including escapeHtml(). Users should update to a version of Malla that includes this commit (any commit ≥ 4086e2b). As a workaround, restrict access to the Malla dashboard to trusted networks only and avoid connecting malla-capture to public MQTT brokers until patched (Malla Advisory, Patch Commit).