Description

Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-21T22:16:37.563Z",
  "pubdate": "2026-08-21T22:16:37.563Z",
  "executiveSummary": "Malla, a web analyzer for Meshtastic networks utilizing MQTT data, suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists due to the lack of proper input sanitization when storing node names (long_name and short_name) received via MQTT into an SQLite database, coupled with the absence of output escaping when these values are rendered into the DOM. An attacker capable of participating on a public Meshtastic MQTT broker can leverage this weakness by configuring a malicious node name containing arbitrary JavaScript payloads. When a user visits the Malla dashboard, the injected script executes within the context of their browser session. This exposes dashboard visitors to severe security risks, including session hijacking, data theft, and unauthorized actions performed on behalf of the victim. Exploitation requires network access to the target MQTT broker and malicious payload delivery via node telemetry, but does not require prior authentication to the Malla application itself. The vulnerability is resolved in commit 4086e2b5f61615a813b70b25bc76095083552135.",
  "technicalDetails": "The vulnerability stems from insufficient input validation and output encoding in the Malla web analyzer application. Specifically, telemetry data transmitted across Meshtastic networks via MQTT includes node metadata fields such as long_name and short_name. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, the application ingests these MQTT messages and persists the raw string values directly into an SQLite database without performing any sanitization or neutralization of dangerous characters. Subsequently, when the web interface queries the database and renders the node names into the Document Object Model (DOM), the application fails to apply context-aware output escaping. This architectural oversight transforms stored data into executable script code. The attack flow begins when an unauthenticated malicious actor connects to a public Meshtastic MQTT broker utilized by the Malla monitoring instance. The attacker crafts and broadcasts node advertisement or telemetry packets containing a malicious payload disguised as the long_name or short_name parameters—for example, incorporating HTML script tags or event handlers containing JavaScript. Malla captures this MQTT traffic, processes the payload, and commits the unescaped malicious string into its SQLite backend. When any administrative user or dashboard visitor loads the Malla web interface, the application retrieves the compromised node records and injects the raw payload directly into the rendered HTML pages. The victim's browser parses the injected payload as legitimate code and executes it within the security context of the origin, inheriting the victim's session privileges. Post-exploitation impact depends on the permissions and actions available to the viewing user, potentially allowing attackers to pivot through the interface, extract sensitive operational data, or manipulate the monitoring environment."
}