CVE-2026-33044
CVE-2026-33044 · Home Assistant has stored XSS in Map-card through malicious device name
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.
CVSS 7.3 · High · EPSS 0.2% · Fix available
- Published
- Updated
Stack: python
Affected products and versions
core
- Versions
- >= 2020.02, < 2026.01: Affected
No fix published
homeassistant PyPI
- Versions
- 2020.12.0
- 2020.12.1
- 2020.12.2
- 2021.1.0
- 2021.1.0b0
- 2021.1.0b1
- 2021.1.0b2
- 2021.1.0b3
- 2021.1.1
- 2021.1.2
- 2021.1.3
- 2021.1.4
- 2021.1.5
- 2021.10.0
- 2021.10.0b0
- 2021.10.0b1
- 2021.10.0b2
- 2021.10.0b3
- 2021.10.0b4
- 2021.10.0b5
- 2021.10.0b6
- 2021.10.0b7
- 2021.10.0b9
- 2021.10.1
- 2021.10.2
- 2021.10.3
- 2021.10.4
- 2021.10.5
- 2021.10.6
- 2021.10.7
- 2021.11.0
- 2021.11.0b0
- 2021.11.0b1
- 2021.11.0b2
- 2021.11.0b3
- 2021.11.0b4
- 2021.11.0b5
- 2021.11.1
- 2021.11.2
- 2021.11.3
- 2021.11.4
- 2021.11.5
- 2021.12.0
- 2021.12.0b0
- 2021.12.0b1
- 2021.12.0b2
- 2021.12.0b3
- 2021.12.0b4
- 2021.12.0b5
- 2021.12.0b6
- 2021.12.0b7
- 2021.12.1
- 2021.12.10
- 2021.12.2
- 2021.12.3
- 2021.12.4
- 2021.12.5
- 2021.12.6
- 2021.12.7
- 2021.12.8
- 2021.12.9
- 2021.2.0
- 2021.2.0b0
- 2021.2.0b1
- 2021.2.0b2
- 2021.2.0b3
- 2021.2.0b4
- 2021.2.0b5
- 2021.2.1
- 2021.2.2
- 2021.2.3
- 2021.3.0
- 2021.3.0b0
- 2021.3.0b1
- 2021.3.0b2
- 2021.3.0b3
- 2021.3.0b4
- 2021.3.0b5
- 2021.3.0b6
- 2021.3.0b7
- 2021.3.1
- 2021.3.2
- 2021.3.3
- 2021.3.4
- 2021.4.0
- 2021.4.0b0
- 2021.4.0b1
- 2021.4.0b2
- 2021.4.0b3
- 2021.4.0b4
- 2021.4.0b5
- 2021.4.0b6
- 2021.4.1
- 2021.4.2
- 2021.4.3
- 2021.4.4
- 2021.4.5
- 2021.4.6
- 2021.5.0
- 2021.5.0b0
- 2021.5.0b1
- 2021.5.0b2
- 2021.5.0b3
- 2021.5.0b4
- 2021.5.0b5
- 2021.5.0b6
- 2021.5.0b7
- 2021.5.0b8
- 2021.5.1
- 2021.5.2
- 2021.5.3
- 2021.5.4
- 2021.5.5
- 2021.6.0
- 2021.6.0b0
- 2021.6.0b1
- 2021.6.0b2
- 2021.6.0b3
- 2021.6.0b4
- 2021.6.0b5
- 2021.6.1
- 2021.6.2
- 2021.6.3
- 2021.6.4
- 2021.6.5
- 2021.6.6
- 2021.7.0
- 2021.7.0b0
- 2021.7.0b1
- 2021.7.0b2
- 2021.7.0b3
- 2021.7.0b4
- 2021.7.0b5
- 2021.7.0b6
- 2021.7.1
- 2021.7.2
- 2021.7.3
- 2021.7.4
- 2021.8.0
- 2021.8.0b0
- 2021.8.0b1
- 2021.8.0b10
- 2021.8.0b2
- 2021.8.0b3
- 2021.8.0b4
- 2021.8.0b5
- 2021.8.0b6
- 2021.8.0b7
- 2021.8.0b8
- 2021.8.0b9
- 2021.8.1
- 2021.8.2
- 2021.8.3
- 2021.8.4
- 2021.8.5
- 2021.8.6
- 2021.8.7
- 2021.8.8
- 2021.9.0
- 2021.9.0b0
- 2021.9.0b1
- 2021.9.0b2
- 2021.9.0b3
- 2021.9.0b4
- 2021.9.0b5
- 2021.9.0b6
- 2021.9.0b7
- 2021.9.1
- 2021.9.2
- 2021.9.3
- 2021.9.4
- 2021.9.5
- 2021.9.6
- 2021.9.7
- 2022.10.0
- 2022.10.0b0
- 2022.10.0b1
- 2022.10.0b2
- 2022.10.0b3
- 2022.10.0b4
- 2022.10.0b5
- 2022.10.0b6
- 2022.10.1
- 2022.10.2
- 2022.10.3
- 2022.10.4
- 2022.10.5
- 2022.11.0
- 2022.11.0b0
- 2022.11.0b1
- 2022.11.0b2
- 2022.11.0b3
- 2022.11.0b4
- 2022.11.0b5
- 2022.11.0b6
- 2022.11.0b7
- 2022.11.1
- 2022.11.2
- 2022.11.3
- 2022.11.4
- 2022.11.5
- 2022.12.0
- 2022.12.0b0
- 2022.12.0b1
- 2022.12.0b2
- 2022.12.0b3
- 2022.12.0b4
- 2022.12.0b5
- 2022.12.0b6
- 2022.12.0b7
- 2022.12.1
- 2022.12.2
- 2022.12.3
- 2022.12.4
- 2022.12.5
- 2022.12.6
- 2022.12.7
- 2022.12.8
- 2022.12.9
- 2022.2.0
- 2022.2.0b0
- 2022.2.0b1
- 2022.2.0b2
- 2022.2.0b3
- 2022.2.0b4
- 2022.2.0b5
- 2022.2.0b6
- 2022.2.1
- 2022.2.2
- 2022.2.3
- 2022.2.4
- 2022.2.5
- 2022.2.6
- 2022.2.7
- 2022.2.8
- 2022.2.9
- 2022.3.0
- 2022.3.0b0
- 2022.3.0b1
- 2022.3.0b2
- 2022.3.0b3
- 2022.3.0b4
- 2022.3.0b5
- 2022.3.0b6
- 2022.3.1
- 2022.3.2
- 2022.3.3
- 2022.3.4
- 2022.3.5
- 2022.3.6
- 2022.3.7
- 2022.3.8
- 2022.4.0
- 2022.4.0b0
- 2022.4.0b1
- 2022.4.0b2
- 2022.4.0b3
- 2022.4.0b4
- 2022.4.0b5
- 2022.4.1
- 2022.4.2
- 2022.4.3
- 2022.4.4
- 2022.4.5
- 2022.4.6
- 2022.4.7
- 2022.5.0
- 2022.5.0b0
- 2022.5.0b1
- 2022.5.0b2
- 2022.5.0b3
- 2022.5.0b4
- 2022.5.0b5
- 2022.5.0b6
- 2022.5.0b7
- 2022.5.1
- 2022.5.2
- 2022.5.3
- 2022.5.4
- 2022.5.5
- 2022.6.0
- 2022.6.0b0
- 2022.6.0b1
- 2022.6.0b2
- 2022.6.0b3
- 2022.6.0b4
- 2022.6.0b5
- 2022.6.0b6
- 2022.6.0b7
- 2022.6.1
- 2022.6.2
- 2022.6.3
- 2022.6.4
- 2022.6.5
- 2022.6.6
- 2022.6.7
- 2022.7.0
- 2022.7.0b0
- 2022.7.0b1
- 2022.7.0b2
- 2022.7.0b3
- 2022.7.0b4
- 2022.7.0b5
- 2022.7.1
- 2022.7.2
- 2022.7.3
- 2022.7.4
- 2022.7.5
- 2022.7.6
- 2022.7.7
- 2022.8.0
- 2022.8.0b0
- 2022.8.0b1
- 2022.8.0b2
- 2022.8.0b3
- 2022.8.0b4
- 2022.8.0b5
- 2022.8.0b6
- 2022.8.0b7
- 2022.8.1
- 2022.8.2
- 2022.8.3
- 2022.8.4
- 2022.8.5
- 2022.8.6
- 2022.8.7
- 2022.9.0
- 2022.9.0b0
- 2022.9.0b1
- 2022.9.0b2
- 2022.9.0b3
- 2022.9.0b4
- 2022.9.0b5
- 2022.9.0b6
- 2022.9.1
- 2022.9.2
- 2022.9.3
- 2022.9.4
- 2022.9.5
- 2022.9.6
- 2022.9.7
- 2023.1.0
- 2023.1.0b0
- 2023.1.0b1
- 2023.1.0b2
- 2023.1.0b3
- 2023.1.0b4
- 2023.1.0b5
- 2023.1.1
- 2023.1.2
- 2023.1.3
- 2023.1.4
- 2023.1.5
- 2023.1.6
- 2023.1.7
- 2023.10.0
- 2023.10.0b0
- 2023.10.0b1
- 2023.10.0b2
- 2023.10.0b3
- 2023.10.0b4
- 2023.10.0b6
Update to 2026.01