CVE-2026-43980: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in zenitraM malla

Malla, a web analyzer for Meshtastic networks, suffered from an XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, node names (long_name, short_name) received via MQTT were stored in SQLite without sanitization and then rendered into the DOM without escaping. This flaw allowed any participant on a public Meshtastic MQTT broker to set a malicious node name that executes arbitrary JavaScript in the browsers of all Malla dashboard visitors. The vulnerability was addressed and fixed in commit 4086e2b5f61615a813b70b25bc76095083552135.

An attacker controlling a node name on a public Meshtastic MQTT broker can execute arbitrary JavaScript in the browsers of users viewing the Malla dashboard. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS score is 6.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability at a low level.

The vulnerability has been fixed in commit 4086e2b5f61615a813b70b25bc76095083552135. Users and administrators should update to the fixed version of Malla to remediate this issue. No additional mitigation is required once the fix is applied.