CVE-2025-53637: Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive…

PriorityP346high8CVSS 3.1

AVNACLPRLUIRSUCHIHAH

EPSS

0.33%

24.6th percentile

Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
meshtastic	firmware	—	—
meshtastic	meshtastic_firmware	< 2.6.6	2.6.6

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.