CVE-2026-43980: Malla Web Analyzer XSS Vulnerability

CVE-2026-43980 Overview

CVE-2026-43980 is a stored cross-site scripting (XSS) vulnerability in Malla, a web analyzer for Meshtastic networks that ingests MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, Malla stores Meshtastic node code names (long_name and short_name) received via MQTT in SQLite without sanitization. The dashboard then renders these values into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can publish a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.

Critical Impact
Attackers with access to a public Meshtastic MQTT broker can execute arbitrary JavaScript in the browser sessions of all Malla dashboard users, enabling session theft, dashboard defacement, and pivoting to internal networks.

Affected Products

Malla Meshtastic web analyzer (all versions prior to commit 4086e2b5f61615a813b70b25bc76095083552135)
Deployments ingesting data from public Meshtastic MQTT brokers
Any Malla instance exposing the dashboard to authenticated or unauthenticated viewers

Discovery Timeline

2026-08-21 - CVE-2026-43980 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-43980

Vulnerability Analysis

The flaw is a classic stored XSS [CWE-79] in which untrusted input flows from the MQTT ingest layer into a persistent SQLite store, and then into the browser DOM without contextual output encoding. Meshtastic node metadata such as long_name and short_name is attacker-controlled: anyone participating on the public MQTT broker can advertise arbitrary strings. Because Malla treats these strings as trusted display data, HTML and JavaScript payloads embedded in a node name are rendered as live markup on the analyzer dashboard.

Exploitation requires user interaction: a victim must load a Malla page that renders the poisoned node record. Once the page loads, the payload runs with the origin privileges of the Malla application, allowing session hijacking, CSRF against authenticated endpoints, and phishing overlays.

Root Cause

The root cause is the absence of output encoding when constructing HTML from database-backed node fields. The pre-patch frontend used template literals that interpolated raw values directly into innerHTML-style sinks. Input-side controls at the MQTT ingestion boundary did not strip or escape HTML metacharacters, so payloads persisted verbatim in SQLite.

Attack Vector

The attack path is remote and network-based. An attacker connects to a public Meshtastic MQTT broker, publishes a node announcement whose long_name or short_name contains a JavaScript payload, and waits for the payload to be ingested by any Malla instance subscribing to that broker. When a dashboard user opens the affected view, the browser parses and executes the payload.

javascript

// Security patch in src/malla/static/js/timezone-utils.js
// Pre-patch: unsafe template-literal HTML with only manual escaping
// const escapedId = escapeHtml(id);
// return `<a href="${link}" ...>
//     <small class="timestamp-display" data-timestamp="${escapedTimestamp}">${escapedFormattedTime}</small>
// </a>`;

// Post-patch: safe DOM construction via helper functions
const href = safePath(linkPath.replace('{id}', encodeURIComponent(String(id))));
const small = el('small', {
    className: 'timestamp-display',
    dataset: { timestamp: timestamp }
}, formattedTime);

return el('a', {
    href,
    className: 'text-decoration-none',
    // ...
});

Source: GitHub Commit 4086e2b for Malla

Detection Methods for CVE-2026-43980

Indicators of Compromise

MQTT messages advertising Meshtastic node metadata containing HTML tags, <script>, on*= event handlers, or javascript: URIs in long_name or short_name fields.
SQLite rows in the Malla database with node name fields containing angle brackets or encoded script payloads.
Unexpected outbound requests from dashboard user browsers to attacker-controlled domains shortly after loading Malla pages.

Detection Strategies

Inspect the Malla node table for records where long_name or short_name fail a strict allowlist of printable, non-markup characters.
Enable Content Security Policy (CSP) reporting on the Malla frontend and monitor for script-src and inline-event violations.
Review browser DevTools or web proxy logs for script execution originating from the Malla origin that references external hosts.

Monitoring Recommendations

Log all MQTT topics and payloads ingested by Malla and alert on non-ASCII or markup-bearing node identifier fields.
Track dashboard user sessions for anomalous token reuse or geographic drift that would indicate session theft via XSS.
Compare deployed Malla commit hashes against 4086e2b5f61615a813b70b25bc76095083552135 and alert on any host running older code.

How to Mitigate CVE-2026-43980

Immediate Actions Required

Update Malla to a build that includes commit 4086e2b5f61615a813b70b25bc76095083552135 or later.
Purge or sanitize existing SQLite records with markup in long_name and short_name before restoring dashboard access.
Rotate any session tokens or API keys that may have been exposed to Malla dashboard users during the vulnerable window.

Patch Information

The fix is delivered in commit 4086e2b5f61615a813b70b25bc76095083552135, which replaces string-concatenated HTML with safe DOM construction helpers (el(), safePath(), encodeURIComponent) across the frontend. Details are documented in GitHub Security Advisory GHSA-ch57-39q2-4crm and PYSEC-2026-2618.

Workarounds

Restrict Malla to a private MQTT broker with authenticated publishers only, eliminating anonymous node name injection.
Deploy a strict Content Security Policy that disallows inline scripts and untrusted script-src origins on the dashboard.
Filter ingested MQTT payloads through an upstream sanitizer that strips HTML metacharacters from node metadata before insertion into SQLite.

bash

# Verify the deployed Malla commit includes the fix
cd /opt/malla
git fetch --all
git log --oneline | grep 4086e2b5f61615a813b70b25bc76095083552135 \
    && echo "Patched" || echo "VULNERABLE - upgrade required"

# Identify potentially poisoned records
sqlite3 malla.db \
    "SELECT node_id, long_name, short_name FROM nodes \
     WHERE long_name LIKE '%<%' OR short_name LIKE '%<%';"