CVE-2026-64823
Received Received - Intake

Cross-Site Scripting in Home Assistant Core

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-64823
EUVD
EUVD-2026-46280

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
home_assistant core to 2026.5.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-64823 is a cross-site scripting (XSS) vulnerability in Home Assistant Core versions before 2026.5.4. It exists in the Shelly integration's async_get_media_image() method where improper input validation allows attackers controlling a Shelly device's thumbnail field to inject arbitrary HTML content via a data URI with a text/html content type. This bypasses image-only restrictions, enabling the media player proxy endpoint to serve attacker-controlled bytes with the text/html Content-Type within the Home Assistant web origin.

Detection Guidance

To detect this vulnerability, check if your Home Assistant Core version is below 2026.5.4. Run the command: 'ha core info' in the Home Assistant CLI. If the version is older, the system is vulnerable. Inspect Shelly integration logs for unusual media image handling or unexpected HTML content in thumbnails.

Impact Analysis

Successful exploitation could lead to theft of session tokens from local storage and unauthorized access to sensitive service endpoints, including controls for locks, alarms, and covers. Attackers could cause the media player proxy endpoint to serve malicious content in the Home Assistant web origin.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling theft of session tokens and unauthorized access to sensitive endpoints. Session token theft could lead to unauthorized data access or modification, violating confidentiality requirements under both regulations. Unauthorized access to controls like locks or alarms may also breach integrity and availability principles in HIPAA for healthcare environments.

Mitigation Strategies

Upgrade Home Assistant Core to version 2026.5.4 or later immediately. This can be done via the Home Assistant UI under Settings > System > Updates or via the CLI with 'ha core update'. Ensure no Shelly devices are using malicious thumbnails by reviewing their configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64823. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart