CVE-2026-43980

Name of the Vulnerable Software and Affected Versions Malla (affected versions not specified)

Description Node names received via MQTT are stored in SQLite without sanitization and rendered into the Document Object Model (DOM) without escaping. This allows unauthenticated remote attackers to set malicious node names via a public Meshtastic MQTT broker, leading to the execution of arbitrary JavaScript in the browser of any Malla dashboard visitor. The issue involves the long name and short name variables. Potential impacts include phishing overlays, forced redirects to malicious websites, injection of third-party scripts, browser resource abuse, and persistent dashboard denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.