What is the CVSS score of CVE-2026-33404?

CVE-2026-33404 has a CVSS 3.1 base score of 3.4 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33404?

Yes, a patch is available for CVE-2026-33404. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-33404

EUVD-2026-19281 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 security-advisories@github.com

XSS Pi Hole Web Interface

3.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.4 LOW

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19281

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

LOW 3.4

DescriptionGitHub Advisory

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping - an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.

AnalysisAI

Pi-hole Admin Interface versions 6.0 through 6.4 fail to escape client hostnames and IP addresses from the FTL database when rendering them into the DOM in the Network page and Dashboard chart tooltips, enabling stored cross-site scripting (XSS) attacks. An authenticated admin with high privileges can inject malicious scripts that execute in the context of other administrators' browsers, though the attack requires initial compromise of a DHCP/DNS client hostname field and circumvention of upstream validation in dnsmasq and FTL. This vulnerability is fixed in version 6.5, and no public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation, also known as Cross-Site Scripting) in the Pi-hole Admin Interface web application. Specifically, client hostnames and IP addresses sourced from the FTL (Faster Than Light, Pi-hole's DNS/DHCP processing engine) database are directly inserted into the DOM via JavaScript in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips) without HTML entity encoding or content security policy enforcement. While dnsmasq and FTL apply upstream validation to block HTML characters via normal DHCP/DNS paths, the web UI layer performs no corresponding output escaping-an inconsistency with other fields in the same files that are properly escaped. This creates a reflected/stored XSS vector if an attacker can control a client hostname field that reaches the FTL database through alternate pathways or if database integrity is compromised.

RemediationAI

Upgrade Pi-hole Admin Interface to version 6.5 or later, which implements output escaping for client hostnames and IP addresses in network.js and charts.js/index.js. No interim workarounds are available beyond restricting admin access to trusted parties and monitoring the FTL database for suspicious hostname entries. Users unable to upgrade immediately should review FTL database entries for HTML/JavaScript content in the NAMES table and remove or sanitize suspicious hostnames. Patch details and release notes are available at https://github.com/pi-hole/web/security/advisories/GHSA-px6w-85wp-ww9v.