CVE-2026-64823 Details
Description
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.
A cross-site scripting vulnerability has been identified in Home Assistant Core versions prior to 2026.5.4, specifically within the Shelly integration's 'async_get_media_image()' method. This vulnerability allows attackers to inject arbitrary HTML content by manipulating a Shelly device's thumb field with a data URI containing a text/html content type, bypassing validation that restricts to image-only formats. Exploitation can lead to the media player proxy endpoint delivering attacker-controlled data with a text/html Content-Type to the Home Assistant web origin. This could facilitate the theft of session tokens from local storage and enable unauthorized access to sensitive service endpoints, including lock, alarm, and cover controls.
Users can upgrade to Home Assistant Core version 2026.5.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/home-assistant/core/commit/894a68acb678afc382fe5ea9002e61ab7f862011 | [email protected] | Source CodeVendor |
| https://github.com/home-assistant/core/pull/171585 | [email protected] | Issue TrackingVendor |
| https://github.com/home-assistant/core/releases/tag/2026.5.4 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/home-assistant-core-xss-via-shelly-media-player-py-thumb-uri | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Home Assistant Core | < 2026.5.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |