What is the CVSS score of CVE-2026-33405?

CVE-2026-33405 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33405?

Yes, a patch is available for CVE-2026-33405. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-33405

EUVD-2026-19283 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 GitHub_M

XSS Pi Hole Web

3.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

3.1 LOW

AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5

EUVD ID Assigned

Apr 06, 2026 - 15:30 euvd

EUVD-2026-19283

Analysis Generated

Apr 06, 2026 - 15:30 vuln.today

CVE Published

Apr 06, 2026 - 15:23 nvd

LOW 3.1

DescriptionGitHub Advisory

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

AnalysisAI

Stored HTML injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows authenticated high-privilege users to inject unescaped HTML into query log details via the formatInfo() function, affecting the upstream, client IP, and error description fields. JavaScript execution is mitigated by Content Security Policy, limiting the practical impact to HTML-based attacks such as DOM manipulation or phishing content injection. The vulnerability is fixed in version 6.5.

Technical ContextAI

The Pi-hole Admin Interface (cpe:2.3:a:pi-hole:web:*:*:*:*:*:*:*:*) is a web-based management console for Pi-hole's DNS-level filtering service. The formatInfo() function in queries.js fails to escape three data fields when rendering expanded query rows in the Query Log, creating a Stored XSS vulnerability classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The same fields are correctly escaped in the table view's rowCallback function, indicating this was a code maintenance oversight rather than a systemic architectural flaw. The server's Content Security Policy with script-src 'self' blocks inline and external script execution, significantly narrowing the attack surface.

RemediationAI

Vendor-released patch: Pi-hole Admin Interface version 6.5 and later. Upgrade the Admin Interface component to version 6.5 or newer to receive the fix that properly escapes data.upstream, data.client.ip, and data.ede.text fields in the formatInfo() function. Until upgrade is feasible, restrict administrative access to the Pi-hole web console to trusted users and monitor for unusual query log entries that may indicate exploitation attempts. Consult the GitHub Security Advisory at https://github.com/pi-hole/web/security/advisories/GHSA-jx8x-mj2r-62vq for deployment-specific guidance.