CVE-2025-53637: Meshtastic Firmware

High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days.

Meshtastic is an open source mesh networking solution. The main_matrix.yml GitHub Action is triggered by the pull_request_target event, which has extensive permissions, and can be initiated by an attacker who forked the repository and created a pull request. In the shell code execution part, user-controlled input is interpolated unsafely into the code. If this were to be exploited, attackers could inject unauthorized code into the repository. This vulnerability is fixed in 2.6.6.

Affected products

• Meshtastic Meshtastic Firmware: before 2.6.6 (fixed in 2.6.6)

Published 2025-07-10. Last modified 2026-06-17.