GHSA-CH57-39Q2-4CRM malla: Stored XSS via Meshtastic node names in multiple frontend pages

Node names longname, shortname received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Affecte...

PT-2026-46117

Name of the Vulnerable Software and Affected Versions Malla affected versions not specified Description Node names received via MQTT are stored in SQLite without sanitization and rendered into the Document Object Model DOM without escaping. This allows unauthenticated remote attackers to set...