Read the docs
TI-2026-46348 Aliases CVE-2026-64823GHSA-r3v5-j696-5grq

Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Priority LOW 11CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Active
Attack complexity
High
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00296 22nd percentileScored 2026-11-07
Fix Fixed Home Assistant Core (home-assistant): 2026.5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistantHome Assistant Corebefore 2026.5.42026.5.4Patch availableCNA
  • Home Assistant Core Vendorhome-assistant Affected before 2026.5.4 Fixed in 2026.5.4 Patch available CNA

Remediation

  • Fix · CNA Home Assistant Core (home-assistant) Fixed in 2026.5.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-64823
  2. 2026-10-03 Alias added: GHSA-r3v5-j696-5grq

References

Patch 1

Other 2

  • TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
  • TI-2021-22555 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover CVSS 4.0HIGH 8.7
  • TI-2026-61899 Home Assistant: XSS in Statistics Graph Card CVSS 4.0CRITICAL 9.3
  • TI-2026-46349 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore CVSS 4.0CRITICAL 9.3
  • TI-2026-40307 Cleartext transmission of sensitive information in home-assistant core CVSS 3.1HIGH 7.5
  • TI-2025-38490 Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name CVSS 4.0HIGH 8.5
See all 32 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences