CyberRota Analysis
AI-GeneratedThe vulnerability affects Malla, a web analyzer for Meshtastic networks, where unsanitized MQTT data is stored in SQLite and rendered in the DOM, allowing attackers to inject malicious JavaScript. This could lead to cross-site scripting (XSS) attacks, impacting any user accessing the Malla dashboard. Organizations utilizing Malla should prioritize this issue to protect their users from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.