Which versions of Home Assistant are affected by CVE-2026-33044?

Home Assistant's Map card component contains a cross-site scripting vulnerability affecting versions 2020.02 through 2026.0.x that allows authenticated users to execute arbitrary JavaScript in other…. A patch is available.

How to fix or mitigate CVE-2026-33044?

Within 24 hours: Inventory all Home Assistant deployments and document current versions across the organization. Within 7 days: Upgrade all affected Home Assistant instances to version 2026.01 or later. Within 30 days: Conduct access review of Home Assistant user accounts with entity creation/modification permissions and implement principle of least privilege restrictions on device naming capabilities.

Home Assistant CVE-2026-33044

Q: What is the CVSS score of CVE-2026-33044?

CVE-2026-33044 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-16774 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-27 security-advisories@github.com

GHSA-r584-6283-p7xc

XSS Home Assistant

7.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 27, 2026 - 20:22 euvd

EUVD-2026-16774

Analysis Generated

Mar 27, 2026 - 20:22 vuln.today

CVE Published

Mar 27, 2026 - 20:16 nvd

HIGH 7.3

DescriptionGitHub Advisory

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.

AnalysisAI

Cross-site scripting in Home Assistant's Map card component allows authenticated users to inject malicious JavaScript through device entity names, executing arbitrary code in victims' browsers when they hover over map information points. Affects Home Assistant versions 2020.02 through 2026.0.x, with fix released in version 2026.01. No public exploit identified at time of analysis, though CVSS E:P indicates proof-of-concept code exists. EPSS data not available, but exploitation requires authenticated access and user interaction (hovering), limiting practical attack surface.

Technical ContextAI

This is a stored XSS vulnerability (CWE-79) in Home Assistant's dashboard rendering engine, specifically within the Map card component. The vulnerability stems from improper sanitization of user-controlled device entity names before rendering them in the web interface. When an authenticated user creates or modifies a device entity name to include malicious JavaScript, this payload is stored in the Home Assistant database. The XSS triggers when another user views a dashboard containing a Map card that includes the compromised entity and hovers over its information marker, causing the browser to execute the injected script in the victim's session context. The attack vector (AV:N) indicates network-based exploitation, but requires low-privileged authentication (PR:L) and active user interaction (UI:A) with specific UI elements. The vulnerability affects the core Home Assistant software (home-assistant/core repository), which serves as the central automation platform processing device states and rendering the web interface.

RemediationAI

Upgrade to Home Assistant Core version 2026.01 or later, which includes input sanitization fixes for device entity names rendered in Map card components. The patch addresses the root cause by implementing proper HTML encoding and XSS filtering before rendering user-controlled entity names in dashboard contexts. Organizations should prioritize upgrading instances with multiple authenticated users or those exposed to untrusted parties. As an interim workaround until patching, administrators can audit existing device entity names for suspicious JavaScript patterns (script tags, event handlers, data URIs) and sanitize or remove Map cards from shared dashboards. Review user account permissions to ensure principle of least privilege, limiting device entity modification rights to trusted administrators only. After upgrading, conduct security review of all device entity names created during the vulnerability window (2020.02 through pre-2026.01 versions) to identify and remediate any injected payloads. Full security advisory with technical details available at https://github.com/home-assistant/core/security/advisories/GHSA-r584-6283-p7xc.