The vulnerability in Malla allows any participant of a public Meshtastic MQTT broker to set a node name containing malicious JavaScript. These names are stored directly in the SQLite database without sanitization and later rendered into the dashboard DOM, enabling stored cross‑site scripting. Attackers can thus execute arbitrary client‑side scripts when any user visits the Malla web interface. The impact is limited to the browsers of dashboard viewers, which can be abused for defacement, credential theft, or the execution of more complex client‑side attacks.

The affected product is Malla by zenitraM. The vulnerability applies to all releases that precede commit 4086e2b5f61615a813b70b25bc76095083552135, as that commit contains the sanitisation fix. No specific version numbers are listed in the advisory, so administrators should upgrade to the latest release that includes the commit or verify that the codebase contains the patch.

With a CVSS score of 6.3, the vulnerability represents a moderate severity issue. Because the attack vector relies on a public MQTT broker, any malicious participant can inject the payload; however, exploitation requires the victim to load the Malla dashboard. The EPSS score is not available, and the CVE is not currently listed in CISA’s KEV catalog. Nonetheless, the breadth of potentially affected users and the ease of exploitation via an untrusted MQTT broker make prompt remediation advisable.