6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-43980

CVE-2026-43980: malla: Stored XSS via Meshtastic node names in multiple frontend pages

Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.

Affected files:

src/malla/templates/traceroute_graph.html (line ~832)
src/malla/templates/map.html (lines ~945, 1078)
src/malla/templates/packet_detail.html (lines ~1402, 1452)
src/malla/static/js/relay_node_analysis.js (line ~124)

Steps to reproduce

Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e <img src=x onerror=alert(1)>
Wait for malla-capture to store it
Open the dashboard

Impact

Allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as:

Phishing overlays
Force redirect to malicious websites
Injection of arbitrary third-party scripts (no CSP restrictions)
Browser resource abuse
Persistent dashboard denial of service

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-43980

CVE-2026-43980:

6.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
malla	pip	<= 0.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic stored Cross-Site Scripting (XSS) issue. Node information, specifically the long_name and short_name, is received from an external source (MQTT) and stored in the application's database without proper sanitization. This user-provided data is then rendered on multiple pages of the web dashboard without being properly escaped for the HTML context.

The analysis of the patch commit 4086e2b5f61615a813b70b25bc76095083552135 reveals a widespread pattern of insecurely constructing HTML by concatenating strings containing this raw node data. This generated HTML is then assigned to the innerHTML property of DOM elements, or used in contexts where HTML is interpreted, such as Bootstrap tooltips with data-bs-html="true".

The fix implemented in the commit is a major frontend refactoring. It replaces all instances of insecure innerHTML assignments with the use of safe DOM creation APIs (document.createElement, textContent, etc.), encapsulated in new helper functions within src/malla/static/js/dom.js. This ensures that any data from the database is treated as text and not as executable HTML, effectively mitigating the XSS vulnerability across the application.

Vulnerable functions

RelayNodeAnalysis.renderRelayStats

src/malla/static/js/relay_node_analysis.js

The function constructs HTML content for a table cell by concatenating `candidate.node_name` into a string, which is then assigned to the `innerHTML` property. A malicious node name containing HTML and script tags would be executed in the browser.

NodePicker.renderResults

src/malla/static/js/node-picker.js

The function generates a list of nodes as an HTML string. The `displayName`, derived from a node's `long_name` or `short_name`, is embedded in the HTML. Although an `escapeHtml` function was used, the practice of building HTML strings and assigning them to `innerHTML` is insecure. The patch replaces this with direct DOM manipulation, indicating the original implementation was vulnerable to XSS if the escaping was insufficient.

loadCombinedTracerouteGraph

src/malla/templates/components/traceroute_graph.html

Within this function, tooltips for a D3 graph are generated as HTML strings. The `sourceNode.label`, which is derived from a node's name, is concatenated into the string. This HTML is then used to create the tooltip content, leading to a stored XSS vulnerability if the node name is malicious.

updateTopNodesTable

src/malla/templates/dashboard.html

This function populates a table of top nodes. It constructs each row's HTML as a string, including `nodeName` which comes from `node.display_name`. This string is then assigned to the row's `innerHTML`, allowing malicious node names to execute scripts.

renderDirectLinks

src/malla/templates/longest_links.html

The function builds an HTML table of links, creating the HTML as a string. It includes `link.from_node_name` and `link.to_node_name` directly in the anchor tag's content. The entire HTML string is then injected using `innerHTML`, creating an XSS vulnerability.

renderNodeList

src/malla/templates/components/shared_sidebar_assets.html

This function renders a list of nodes in the sidebar. It generates HTML for each node as a string, embedding the `displayName` (derived from the node name) within a `<strong>` tag. The concatenated HTML string for all nodes is then assigned to the container's `innerHTML`, which is an unsafe practice leading to XSS.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.