Is there a patch available for EUVD-2026-46280?

Yes, a patch is available for EUVD-2026-46280. Update the affected software to the latest version immediately.

Home Assistant Core EUVD-2026-46280

Q: What is the CVSS score of EUVD-2026-46280?

EUVD-2026-46280 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-64823 LOW

Cross-site Scripting (XSS) (CWE-79)

2026-07-21 VulnCheck

GHSA-r3v5-j696-5grq

XSS Home Assistant Home Assistant Core

2.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.7 MEDIUM

Network vector via Shelly device thumb field; high complexity due to required device control and user interaction; scope changes as HA web origin is impacted beyond the vulnerable Shelly component; no direct impact on the vulnerable system.

3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 21, 2026 - 15:49 vuln.today

Analysis Generated

Jul 21, 2026 - 15:49 vuln.today

DescriptionCVE.org

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

AnalysisAI

Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The async_get_media_image() method fetches the device's thumb field without validating that the returned content is an image MIME type, permitting a malicious data:text/html URI to be proxied and re-served by the HA backend with Content-Type: text/html to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.

Technical ContextAI

Home Assistant Core (CPE: cpe:2.3:a:home-assistant:home_assistant_core:*:*:*:*:*:*:*:*) is a Python-based home automation platform. Its Shelly integration exposes a media player component whose async_get_media_image() method retrieves thumbnail artwork from Shelly devices via a server-side proxy endpoint. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the method accepted the Shelly device's thumb field value without enforcing an image-only MIME type allowlist. An attacker-supplied data:text/html,... URI is fetched server-side and the raw bytes are proxied to the browser under the HA web origin with the attacker-controlled Content-Type: text/html, causing the browser to render it as an HTML document and execute embedded scripts. The fix in PR #171585 (commit 894a68acb678afc382fe5ea9002e61ab7f862011, released in 2026.5.4) adds MIME type validation to restrict responses to image content types.

RemediationAI

Upgrade to Home Assistant Core 2026.5.4 or later; this release includes the fix from PR #171585 (commit 894a68acb678afc382fe5ea9002e61ab7f862011) which adds MIME type validation to async_get_media_image() enforcing an image-only allowlist. The release is available at https://github.com/home-assistant/core/releases/tag/2026.5.4. If immediate upgrade is not feasible, a targeted compensating control is to remove the Shelly integration from the HA instance (Settings → Devices & Services → Shelly → Delete), which eliminates the vulnerable proxy endpoint entirely at the cost of losing all Shelly device functionality. A narrower workaround is to ensure that Shelly devices on the network cannot receive external configuration changes - placing them on an isolated VLAN with no inbound internet access prevents an external attacker from setting the thumb field, though this does not protect against an attacker already on the local network.