https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 18:43:02 +0000 https://cve.radiocsirt.org/vuln/cve-2026-33044 <p><strong>Affected:</strong> home-assistant core</p> <p>Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.</p> <p><strong>Affected:</strong> home-assistant core</p> <p>Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.</p> https://cve.radiocsirt.org/vuln/cve-2026-33044 https://cve.radiocsirt.org/vuln/ghsa-r584-6283-p7xc <p><strong>Affected:</strong> PyPI: homeassistant</p> <p>### Summary An authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point (The lines or the dots representing that device&#39;s movement, as shown in the screenshot below, with the example showing a html-injection using `&lt;s&gt;` to strikethrough the text) &lt;img width=&#34;348&#34; height=&#34;355&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1af3ef33-3a72-4816-8ade-e6405aace176&#34; /&gt;</p> <p>This allows an authenticated user to execute JavaScript in the context of any other users accessing a dashboard.</p> <p>### Details</p> <p>The vulnerability exists in the map-card by adding a malicious entity and having the property `hours_to_show` set. See example below, with the malicious entity being `Pixel 9 &lt;s&gt; Fold Robin {{7*7}}`: Map card with malicious device entity: &lt;img width=&#34;338&#34; height=&#34;332&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/15229cc3-1b69-438c-9ee5-cbfa9483aec9&#34; /&gt;</p> <p>YAML-view of same card: &lt;img width=&#34;338&#34; height=&#34;198&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/cd579266-75c3-4cdf-9d08-1544a6887feb&#34; /&gt;</p> <p>This issue largely resembles the issue documented in: [CVE-2025-62172](https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m), but with an entity which can be displayed in a Map, instead of in an energy-dashboard.</p> <p>### PoC 1. Register a new…</p> <p><strong>Affected:</strong> PyPI: homeassistant</p> <p>### Summary An authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point (The lines or the dots representing that device&#39;s movement, as shown in the screenshot below, with the example showing a html-injection using `&lt;s&gt;` to strikethrough the text) &lt;img width=&#34;348&#34; height=&#34;355&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/1af3ef33-3a72-4816-8ade-e6405aace176&#34; /&gt;</p> <p>This allows an authenticated user to execute JavaScript in the context of any other users accessing a dashboard.</p> <p>### Details</p> <p>The vulnerability exists in the map-card by adding a malicious entity and having the property `hours_to_show` set. See example below, with the malicious entity being `Pixel 9 &lt;s&gt; Fold Robin {{7*7}}`: Map card with malicious device entity: &lt;img width=&#34;338&#34; height=&#34;332&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/15229cc3-1b69-438c-9ee5-cbfa9483aec9&#34; /&gt;</p> <p>YAML-view of same card: &lt;img width=&#34;338&#34; height=&#34;198&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/cd579266-75c3-4cdf-9d08-1544a6887feb&#34; /&gt;</p> <p>This issue largely resembles the issue documented in: [CVE-2025-62172](https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m), but with an entity which can be displayed in a Map, instead of in an energy-dashboard.</p> <p>### PoC 1. Register a new…</p> https://cve.radiocsirt.org/vuln/ghsa-r584-6283-p7xc