Web EUVD-2026-19283

CVSS 3.1 reflects low overall severity due to four mitigating factors: local attack vector (AV:L) limits reach to users with direct web console access, high privilege requirement (PR:H) restricts exploitation to administrators, user interaction required (UI:R) necessitates victim action to expand a query row, and confidentiality/integrity impact are low (C:L, I:L) with no availability impact. EPSS data is not provided, but the combination of CSP mitigation, administrative privilege barrier, and stored (not directly injectable) vector suggests exploitation probability is low despite public awareness. KEV status and POC information are not available; however, the straightforward nature of HTML injection in web applications means proof-of-concept development is trivial if the vulnerability is widely known. Real-world risk is moderate for multi-user or compromised administrative environments but minimal for typical single-administrator Pi-hole deployments.

An authenticated administrator with high-privilege access to the Pi-hole web console expands a query row in the Query Log containing attacker-controlled data in the upstream field (e.g., a malicious upstream DNS name or response that was captured as a query). The formatInfo() function renders this unescaped HTML, allowing injection of DOM elements such as <img> tags with malicious src attributes or <iframe> elements to redirect users. While inline JavaScript execution is blocked by CSP, the attacker could achieve credential harvesting via a phishing form injected into the page context or perform UI redressing attacks. No public exploit code is currently documented, but the vulnerability requires an administrator to both possess and expand a specially crafted query row, making opportunistic exploitation unlikely.