MeshMonitor v4.17.2-rc6

⚠️ Pre-release. This is a release candidate for testing. Do not run it against production systems.

This RC is a security-hardening release. It ships the full remediation of an automated penetration test (Shannon by Keygraph) run against a MeshMonitor instance: 34 proven findings fixed across 12 PRs, spanning authenticated RCE, cross-site request forgery, path traversal, secret exposure, stored XSS, SSRF, and broken authorization, plus auth/session hardening and a content-security-policy rewrite. Every fix landed with regression tests and green CI. The headline items: the script engine can no longer be used for code execution by a non-admin or across sources, and its child processes no longer inherit server secrets; the CSRF exemption now requires a validated API token instead of any bearer header; backup download/delete paths are confined to the backup directory; full channel PSKs are no longer handed to read-only users; GeoJSON and analytics inputs are context-encoded against stored XSS; the SSRF guard's IPv4-mapped-IPv6 bypass is closed and outbound settings URLs are guarded; several routes that checked a permission on any source now check the right source; password changes and resets invalidate other sessions; MFA backup codes can no longer be double-spent; and production now serves a nonce-based CSP with no unsafe-inline/unsafe-eval in script-src. Three latent issues uncovered during remediation (a remote argv-injection vector, an ungated automation-enable path, and the always-on CSP weakness) were also fixed. No functional features were removed; a few actions were tightened to admin-only or properly source-scoped — see Upgrade notes.

Security

Script-engine RCE: require execute permission equal to upload, strip secrets from the child env, add --ignore-scripts, block Python stdlib shadowing, and fix argv injection — #6089
Remote argv injection via over-the-air node names in the meshtastic script runners — #6101
CSRF bypass: validate the API token before skipping CSRF instead of trusting any Authorization: Bearer header — #6088
Backup path traversal + authorization: confine read/delete to the backup directory, admin-gate system backups, source-scope device backups — #6094
Channel PSK exposure: gate PSK export/encode behind write, mask the anonymous preview, add channel-db ownership checks — #6093
Stored XSS in analytics settings: context-correct encoding + admin-gate the provider config — #6092
Stored XSS in GeoJSON popups/tooltips: HTML-escape feature properties before Leaflet renders them — #6091
SSRF: close the IPv4-mapped-IPv6 guard bypass, guard outbound Apprise/translation/MeshCore-connect URLs, admin-gate global-only settings — #6098
Authorization: enforce per-source permission at automation run-now, and at automation enable / PUT {enabled:true} — #6095, #6100
Auth/session/DB hardening: invalidate sessions on password change/reset, constant-time login, atomic MFA backup-code consume, gate health/default-password disclosure, validate news-status input — #6097
Nonce-based CSP: drop unsafe-inline/unsafe-eval from script-src in production (previously only strict when COOKIE_SECURE=true, which defaults false) — #6102

Issues Resolved

Closes the 38 findings from the Shannon assessment (GHSA-5jrc-pmm4-wxc6) plus three follow-ups uncovered during remediation. 34 findings were fixed; 3 were verified as working-as-designed and closed; 1 (the CSP weakness) was fixed here.

Upgrade notes

A few operations were tightened as part of the authorization fixes. These affect non-admin users only; admins are unaffected:

Script management and execution are now admin-only.
Creating/listing/deleting system backups requires admin; device backups require the permission on the primary (or named) source.
Exporting a full channel PSK (/channels/:id/export, /channels/encode-url) now requires write, not read.
Global-only settings can only be set by an admin writing globally.
MeshCore TCP connect no longer accepts a loopback (127.0.0.1) host — use the device's LAN IP.
GET /api/health and the default-password status endpoint return minimal data to anonymous callers.

If you enable a web-analytics provider, verify its inline snippet runs after upgrading — the new CSP nonce covers it, but that path was unit-tested rather than browser-tested.

Full changelog: v4.17.2-rc5...v4.17.2-rc6