🚨
Critical GitHub Actions Supply Chain Flaw in Meshtastic
Maintainers of Meshtastic deployments and forks should update immediately. This is a maximum-severity CI/CD supply chain issue that could expose repository secrets and compromise development infrastructure.
CVE-2026-44359 is a CRITICAL vulnerability with a CVSS score of 10.0 affecting Meshtastic before version 2.7.21.1370b23. The project’s GitHub Actions workflow used pull_request_target to automatically execute attacker-controlled code from external pull requests with repository secrets and elevated GITHUB_TOKEN permissions, which could have resulted in supply chain compromise, self-hosted runner compromise, or repository takeover. Version 2.7.21.1370b23 patches the issue.
🔗 Read more 🔗
Source: NVD
📡
Meshtastic BLE Sync Bug Can Disable iOS Device Management
Users managing Meshtastic radios with the iOS app should update firmware and apps as soon as practical. While this is not a code execution bug, it can significantly disrupt device management across shared mesh networks.
CVE-2026-42566 is a HIGH severity vulnerability with a CVSS score of 7.5 affecting Meshtastic before version 2.7.23.b246bcd. A malformed User.long_name can prevent the iOS app from parsing the node database, causing BLE synchronization failures that make radios effectively unmanageable, and the malformed entry can propagate across the mesh. Firmware and application updates add input sanitization and more graceful handling of malformed encoding sequences.
🔗 Read more 🔗
Source: NVD
⚠️
Unsafe Keras Deserialization Enables Arbitrary Code Execution
Developers and ML platform operators using keras-team/keras version 3.15.0 should prioritize patching if they load models or layer configurations from untrusted sources. Treat externally supplied model artifacts as untrusted until the vulnerability is remediated.
CVE-2026-12484 is a HIGH severity vulnerability with a CVSS score of 7.8 affecting keras-team/keras version 3.15.0. The public keras.layers.TorchModuleWrapper.from_config method performs unsafe PyTorch pickle deserialization by calling torch.load with weights_only=False unless protected by Keras safe mode, allowing arbitrary code execution when untrusted Keras layer configurations are processed.
🔗 Read more 🔗
Source: NVD