What is the CVSS score of CVE-2026-33406?

CVE-2026-33406 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-33406?

Yes, a patch is available for CVE-2026-33406. Update the affected software to the latest version immediately.

Pi Hole CVE-2026-33406

EUVD-2026-19285 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-06 security-advisories@github.com

XSS Pi Hole Web Interface

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

6.5

EUVD ID Assigned

Apr 06, 2026 - 15:22 euvd

EUVD-2026-19285

Analysis Generated

Apr 06, 2026 - 15:22 vuln.today

CVE Published

Apr 06, 2026 - 15:17 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value="" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5.

AnalysisAI

Stored cross-site scripting (XSS) via HTML attribute injection in Pi-hole Admin Interface versions 6.0 through 6.4 allows unauthenticated remote attackers to perform UI redressing and information disclosure by injecting double quotes into configuration values displayed in settings-advanced.js, exploitable through malicious teleporter backup imports that bypass server-side field validation.

Technical ContextAI

Pi-hole's /api/config endpoint returns configuration parameters that are directly interpolated into HTML value="" attributes in settings-advanced.js without HTML entity encoding or attribute escaping. The vulnerability exploits CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic XSS class. When a double quote character appears in any config value, it breaks out of the attribute context and allows injection of additional HTML attributes (e.g., onmouseover, style, data- attributes). While the server implements Content-Security-Policy with script-src 'self', which prevents inline or external script execution, injected attributes can still modify element styling via style attributes or class assignments, enabling UI redressing attacks (clickjacking, form field manipulation) and potential information disclosure through CSS-based exfiltration techniques. The attack surface is expanded by the teleporter backup import mechanism, which accepts serialized configuration data and bypasses the per-field server-side validation that might otherwise sanitize individual config parameters during normal API operations.

RemediationAI

Vendor-released patch: upgrade to Pi-hole Admin Interface version 6.5 or later. Users on versions 6.0-6.4 should immediately apply the patch by updating their Pi-hole installation through the standard update mechanism or by pulling the latest release from the Pi-hole GitHub repository (https://github.com/pi-hole/web). If immediate patching is not possible, restrict administrative access to the Pi-hole Admin Interface to trusted networks only (via firewall rules or VPN), and do not import teleporter backups from untrusted sources, as the teleporter import mechanism is the primary attack surface for injecting malicious config values. Refer to the official GitHub security advisory (https://github.com/pi-hole/web/security/advisories/GHSA-9rfm-c5g6-538p) for additional context and confirmation.