EUVD-2026-54647
GHSA-3f8p-349v-j5h8
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
API injection is straightforward once authenticated (AC:L, PR:L); admin must view dashboard (UI:R); XSS crosses to admin browser context (S:C); no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.
AnalysisAI
Stored cross-site scripting in Domoticz's mobile dashboard (all versions prior to 2026.3) allows any authenticated API user to inject persistent JavaScript payloads via Text or Alert subtype device values. The ng-bind-html rendering path applies only an nl2br() newline transform with no HTML escaping, meaning stored payloads execute in every administrator's browser that loads the mobile dashboard. Successful exploitation enables session cookie theft and account takeover; no active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
Domoticz is an open-source home automation controller (CPE: cpe:2.3:a:domoticz:domoticz:*:*:*:*:*:*:*:*). Its mobile dashboard is built with AngularJS and uses the ng-bind-html directive to render device data into the DOM. The directive treats bound content as trusted HTML unless explicitly sanitized by $sanitize or similar. The application applies only nl2br(), which converts newlines to <br> tags but performs no HTML entity encoding, tag allowlisting, or script stripping. Text and Alert subtype device values are writable via the Domoticz JSON API without further output-encoding, so attacker-controlled strings are stored verbatim and replayed to every browser that loads the dashboard. The root cause class is CWE-79: Improper Neutralization of Input During Web Page Generation (Stored XSS), specifically the failure to encode output at the rendering layer rather than relying on upstream storage restrictions.
RemediationAI
Upgrade to Domoticz version 2026.3 or later; the vendor's History.txt explicitly states this release 'contains important security fixes in the web server and API' and recommends upgrading. The upstream fix commit is https://github.com/domoticz/domoticz/commit/f734fde31a4c2ecab3edd825ceb9854719444f64. If an immediate upgrade is not feasible, restrict API write access to the minimum set of trusted, vetted user accounts - removing write permissions from any account that does not require them eliminates the attacker's injection path. Additionally, disable external network access to the Domoticz web interface by placing it behind a VPN or firewall rule, reducing the authenticated attacker pool to local network users only. Note that disabling API access entirely would break legitimate automation integrations. The VulnCheck advisory at https://www.vulncheck.com/advisories/domoticz-mobile-dashboard-versions-prior-to-stored-xss-via-text-alert-device-rendering provides further context.
Domoticz before 4.10578 allows SQL Injection via the idx parameter in CWebServer::GetFloorplanImage in WebServer.cpp. Ra
Domoticz before 4.10579 neglects to categorize \n and \r as insecure argument options. Rated high severity (CVSS 7.5), t
Domoticz 4.10717 has XSS via item.Name. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, lo
Domoticz versions prior to 2026.1 contain a stored cross-site scripting (XSS) vulnerability in the web interface's Add H
Stack-based buffer overflow in Domoticz's MochadTCP component allows an unauthenticated attacker on the local network to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today