Home Assistant Core
Monthly
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The `async_get_media_image()` method fetches the device's `thumb` field without validating that the returned content is an image MIME type, permitting a malicious `data:text/html` URI to be proxied and re-served by the HA backend with `Content-Type: text/html` to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV, but a vendor-released patch (2026.6.0) exists and the issue was reported by VulnCheck.
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The `async_get_media_image()` method fetches the device's `thumb` field without validating that the returned content is an image MIME type, permitting a malicious `data:text/html` URI to be proxied and re-served by the HA backend with `Content-Type: text/html` to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.