CVE-2025-53637 - CVE House

Back to Database

Status published Medium CVE-2025-53637

Meshtastic allows Command Injection in GitHub Action

4.1 CVSS

Vulnerability Description

Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53637

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from meshtastic

View All →

Meshtastic allows crafting of specific NodeInfo packets that overwrite any publicKey saved in the NodeDB

In Meshtastic, an attacker can spoof licensed amateur flag for a node

Meshtastic firmware allows forged DMs with no PKC to show up as encrypted

Meshtastic-Android vulnerable to forged DMs with no PKC showing up as encrypted

Meshtastic Repeated Public and Private Keypairs

Affected Vendor

meshtastic

View all reports →

Affected Software

firmware

Vulnerable Versions:

>= 2.5.3, < 2.6.6

Timeline

Official Publish: July 10th, 2025

Last Modified: July 11th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1005 Data from Local System

T1041 Exfiltration Over C2 Channel