In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent…
Priority LOW 29CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.
Why it matters now
EPSS 0.00772 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:* | up to 0.56.2 | Vulnerable | home-assistant |
- cpe:2.3:a:home-assistant:home-assistant:*:*:*:*:*:*:*:* Versions up to 0.56.2 Vulnerable ·home-assistant
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-16782
References
More Home-assistant vulnerabilities
- TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
- TI-2026-25491 Home Assistant has stored XSS in history-graphs CVSS 4.0HIGH 7.3
- TI-2026-25490 Home Assistant has stored XSS in Map-card through malicious device name CVSS 4.0HIGH 7.3
- TI-2026-39212 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN CVSS 3.1HIGH 7.6
- TI-2025-40423 Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. CVSS 3.1MEDIUM 4.0
- TI-2023-22289 Lack of XFO header allows clickjacking in Home Assistant Core CVSS 3.1CRITICAL 9.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences