Home

Description

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.

PUBLISHED Reserved 2026-03-17 | Published 2026-03-27 | Updated 2026-04-02 | Assigner GitHub_M




HIGH: 7.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

>= 2020.02, < 2026.01
affected

References

github.com/...t/core/security/advisories/GHSA-r584-6283-p7xc

cve.org (CVE-2026-33044)

nvd.nist.gov (CVE-2026-33044)

Download JSON