CVE-2025-53637: Meshtastic Firmware RCE Vulnerability

CVE-2025-53637 Overview

CVE-2025-53637 is a command injection vulnerability in the Meshtastic firmware repository's GitHub Actions workflow. The main_matrix.yml workflow runs on the pull_request_target event, which grants elevated repository permissions. The workflow interpolates user-controlled input directly into shell code without sanitization. An attacker who forks the repository and opens a pull request can inject arbitrary shell commands into the workflow runner. Successful exploitation allows attackers to push unauthorized code into the upstream repository, exfiltrate secrets, or tamper with firmware releases. Meshtastic patched the issue in firmware version 2.6.6. The vulnerability is tracked under [CWE-78] (OS Command Injection).

Critical Impact
Attackers can inject unauthorized code into the Meshtastic firmware repository through a malicious pull request, compromising the software supply chain for downstream mesh networking deployments.

Affected Products

Meshtastic Firmware versions prior to 2.6.6
The main_matrix.yml GitHub Actions workflow at commit 3fd47d9
Downstream forks that reuse the vulnerable workflow definition

Discovery Timeline

2025-07-10 - CVE-2025-53637 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53637

Vulnerability Analysis

The vulnerability resides in the Meshtastic firmware repository's continuous integration pipeline. The main_matrix.yml workflow uses the pull_request_target trigger, which executes with the permissions of the base repository rather than the forked source. This trigger provides access to repository secrets and write tokens, making any injection within it equivalent to a repository compromise.

Within the workflow's shell step, untrusted pull request metadata is interpolated directly into a run: block using the ${{ ... }} GitHub Actions expression syntax. Because this interpolation occurs before shell parsing, an attacker controlling the input field can break out of the surrounding shell context and execute arbitrary commands on the runner.

Exploitation enables attackers to read GITHUB_TOKEN, exfiltrate organization secrets, and push commits or tags to protected branches. This represents a software supply chain risk against firmware consumed by Meshtastic mesh network devices.

Root Cause

The root cause is the unsafe combination of two GitHub Actions anti-patterns: using pull_request_target for code that handles untrusted input, and interpolating attacker-controlled expressions directly into shell commands. GitHub explicitly warns against this pattern because the expression is substituted into the script before the shell tokenizes the command.

Attack Vector

An attacker forks the Meshtastic firmware repository, crafts a pull request whose metadata contains a shell-injection payload, and submits it. When the workflow triggers, the malicious payload is concatenated into a shell command and executed by the runner with write access to the base repository. No maintainer approval is required for the initial workflow execution under pull_request_target.

Refer to the GitHub Security Advisory GHSA-6mwm-v2vv-pp96 and the vulnerable workflow file for the specific lines affected.

Detection Methods for CVE-2025-53637

Indicators of Compromise

Unexpected commits, tags, or releases authored by the GitHub Actions bot in the Meshtastic firmware repository
Workflow run logs from main_matrix.yml containing shell metacharacters (backticks, $(), semicolons) inside pull request title or branch fields
Outbound network connections from GitHub-hosted runners to attacker-controlled hosts during pull request workflow execution
Rotation events or unauthorized usage of repository secrets associated with the firmware pipeline

Detection Strategies

Audit historical GitHub Actions logs for workflows using pull_request_target that interpolate github.event.pull_request.* fields into run: steps
Enable GitHub Advanced Security code scanning with the actions/security queries to flag expression injection patterns
Review the commit history of .github/workflows/main_matrix.yml for unauthorized modifications prior to the 2.6.6 release

Monitoring Recommendations

Stream GitHub audit logs and Actions workflow run events into a SIEM and alert on first-seen contributor pushes following a fork-based pull request
Monitor repository secret access patterns and alert on secret retrieval outside scheduled release windows
Track changes to branch protection rules and required reviewers on the firmware repository

How to Mitigate CVE-2025-53637

Immediate Actions Required

Upgrade Meshtastic firmware build infrastructure to version 2.6.6 or later, which contains the corrected workflow
Rotate all repository secrets, deploy keys, and personal access tokens that the vulnerable workflow could access
Review commits, tags, and releases created between the introduction of the vulnerable workflow and the patch for unauthorized changes

Patch Information

Meshtastic addressed CVE-2025-53637 in firmware release 2.6.6. The fix removes unsafe expression interpolation from the main_matrix.yml workflow. Maintainers of forks should rebase onto the patched workflow definition or apply equivalent changes. Consult the GitHub Security Advisory GHSA-6mwm-v2vv-pp96 for the authoritative patch reference.

Workarounds

Replace the pull_request_target trigger with pull_request for jobs that do not require write access to the base repository
Move untrusted expression values into environment variables and reference them as "$VAR" inside the shell script rather than interpolating with ${{ }}
Require manual approval for workflow runs originating from first-time contributors by enabling the GitHub Actions fork approval policy
Restrict the GITHUB_TOKEN permissions in the workflow to contents: read and grant write scopes only to jobs that demonstrably need them

bash

# Safer pattern: pass untrusted input through an environment variable
# rather than expression interpolation inside the shell.
jobs:
  build:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - name: Echo PR title safely
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
        run: |
          printf '%s\n' "$PR_TITLE"