Publish Advisories

GHSA-8x6r-g9mw-2r78
GHSA-ch57-39q2-4crm

Author: advisory-database[bot]

advisories/github-reviewed/2026/06/GHSA-8x6r-g9mw-2r78/GHSA-8x6r-g9mw-2r78.json

@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-8x6r-g9mw-2r78",
+  "modified": "2026-06-03T21:05:17Z",
+  "published": "2026-06-03T21:05:17Z",
+  "aliases": [
+    "CVE-2026-42342"
+  ],
+  "summary": "React Router vulnerable to DoS via unbounded path expansion in __manifest endpoint",
+  "details": "There exists a potential DOS attack vector in React Router Framework Mode applications (as well as Remix v2.10.0 - 2.17.4).  Certain requests can be crafted to consume disproportionate resources on the server, resulting in response time degredation and/or service unavailability for end users.\n\n> [!NOTE]\n> This does not impact your React Router application if you are using [Declarative Mode](https://reactrouter.com/start/modes#declarative) (`<BrowserRouter>`) or [Data Mode](https://reactrouter.com/start/modes#data) (`createBrowserRouter`/`<RouterProvider>`).",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "react-router"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "7.0.0"
+            },
+            {
+              "fixed": "7.15.0"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "npm",
+        "name": "@remix-run/server-runtime"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.10.0"
+            },
+            {
+              "fixed": "2.17.5"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78"
+    },
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42342"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/remix-run/react-router"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-400"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-03T21:05:17Z",
+    "nvd_published_at": "2026-06-02T20:16:36Z"
+  }
+}

advisories/github-reviewed/2026/06/GHSA-ch57-39q2-4crm/GHSA-ch57-39q2-4crm.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-ch57-39q2-4crm",
+  "modified": "2026-06-03T21:06:27Z",
+  "published": "2026-06-03T21:06:27Z",
+  "aliases": [
+    "CVE-2026-43980"
+  ],
+  "summary": "malla: Stored XSS via Meshtastic node names in multiple frontend pages",
+  "details": "Node names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping.\nAny participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor.\n\nAffected files:\n\n - src/malla/templates/traceroute_graph.html (line ~832)\n - src/malla/templates/map.html (lines ~945, 1078)\n - src/malla/templates/packet_detail.html (lines ~1402, 1452)\n - src/malla/static/js/relay_node_analysis.js (line ~124)\n\nSteps to reproduce\n\n 1. Publish a Meshtastic NODEINFO_APP packet to any public MQTT broker with long_name set to a HTML entity i.e `<img src=x onerror=alert(1)>`\n 2. Wait for malla-capture to store it\n 3. Open the dashboard\n\nImpact\n\nAllows unauthenticated remote attackers to execute arbitrary JavaScript in the browser, such as: \n\n - Phishing overlays\n - Force redirect to malicious websites\n - Injection of arbitrary third-party scripts (no CSP restrictions)\n - Browser resource abuse \n - Persistent dashboard denial of service",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "PyPI",
+        "name": "malla"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "0.1.7"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/zenitraM/malla/security/advisories/GHSA-ch57-39q2-4crm"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/zenitraM/malla/commit/4086e2b5f61615a813b70b25bc76095083552135"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/zenitraM/malla"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2026-06-03T21:06:27Z",
+    "nvd_published_at": null
+  }
+}