CVE-2026-43980: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in zenitraM malla
CVE-2026-43980 is a cross-site scripting (XSS) vulnerability in zenitraM's malla, a web analyzer for Meshtastic networks. Before a specific commit, node names received via MQTT were stored without sanitization and rendered into the DOM without escaping, allowing malicious JavaScript execution in dashboard visitors' browsers. The issue was fixed in commit 4086e2b5f61615a813b70b25bc76095083552135. The vulnerability has a medium severity score of 6.3 and no known exploits in the wild.
AI Analysis
Technical Summary
The vulnerability in zenitraM malla involves improper neutralization of input during web page generation (CWE-79). Specifically, node names (long_name, short_name) received via MQTT were stored in SQLite without sanitization and rendered into the DOM without escaping, enabling any participant on a public Meshtastic MQTT broker to inject malicious JavaScript that executes in the browser of every Malla dashboard visitor. This issue was resolved by commit 4086e2b5f61615a813b70b25bc76095083552135.
Potential Impact
An attacker controlling a node name on a public Meshtastic MQTT broker can execute arbitrary JavaScript in the browsers of users viewing the Malla dashboard. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 6.3 reflects a medium severity with network attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Mitigation Recommendations
The vulnerability was fixed in commit 4086e2b5f61615a813b70b25bc76095083552135. Users should update to a version of malla that includes this commit to remediate the issue. No other mitigation guidance is provided or necessary once the fix is applied.
CVE-2026-43980: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in zenitraM malla
Description
CVE-2026-43980 is a cross-site scripting (XSS) vulnerability in zenitraM's malla, a web analyzer for Meshtastic networks. Before a specific commit, node names received via MQTT were stored without sanitization and rendered into the DOM without escaping, allowing malicious JavaScript execution in dashboard visitors' browsers. The issue was fixed in commit 4086e2b5f61615a813b70b25bc76095083552135. The vulnerability has a medium severity score of 6.3 and no known exploits in the wild.
CVSS v3.1
Score 6.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in zenitraM malla involves improper neutralization of input during web page generation (CWE-79). Specifically, node names (long_name, short_name) received via MQTT were stored in SQLite without sanitization and rendered into the DOM without escaping, enabling any participant on a public Meshtastic MQTT broker to inject malicious JavaScript that executes in the browser of every Malla dashboard visitor. This issue was resolved by commit 4086e2b5f61615a813b70b25bc76095083552135.
Potential Impact
An attacker controlling a node name on a public Meshtastic MQTT broker can execute arbitrary JavaScript in the browsers of users viewing the Malla dashboard. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS score of 6.3 reflects a medium severity with network attack vector, low complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.
Mitigation Recommendations
The vulnerability was fixed in commit 4086e2b5f61615a813b70b25bc76095083552135. Users should update to a version of malla that includes this commit to remediate the issue. No other mitigation guidance is provided or necessary once the fix is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-04T20:24:31.916Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a88c52facd9273b49c54928
Added to database: 08/21/2026, 21:37:51 UTC
Last enriched: 08/21/2026, 21:52:43 UTC
Last updated: 08/21/2026, 21:52:43 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.