Home-assistant vulnerabilities
We track 19 vulnerabilities in Home-assistant products across 10 products. 19 are rated high or critical, and none are known to be exploited. The most recent was published on September 22, 2026.
Latest Home-assistant vulnerabilities
- 9.3 Critical severity
core: Improper Neutralization of Script-Related HTML Tags in a Web Page
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpo
- 7.1 High severity
core: Missing Authorization
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physi
- 7.1 High severity
core: Missing Authorization
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validatin
- 9.3 Critical severity
Home Assistant Core: Improper Limitation of a Pathname to a Restricted Directory
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attac
- 8.4 High severity
Home Assistant Core: Improper Limitation of a Pathname to a Restricted Directory
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign m
- 7.5 High severity
core: Cleartext Transmission of Sensitive Information
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2025.5.0, The iOS companion app ignores the SSID allowlist for internal networks. The app uses SSID to detect when to use the internal URL, but whenever
- 7.1 High severity
core: Improper Export of Android Application Components
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a f
- 7.6 High severity
core: Exposure of Sensitive Information to an Unauthorized Actor
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integration registers an HTTP endpoint, KonnectedView (homeassistant/components/konnected/__init__.py), that is marked as not req
- 8.3 High severity
core: Improper Control of Generation of Code
Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.e
- 9.6 Critical severity
Home Assistant Operating System: Improper Restriction of Communication Channel to Intended Endpoints
Home Assistant is open source home automation software that puts local control and privacy first. Home Assistant apps (formerly add-ons) configured with host network mode expose unauthenticated endpoints bound to the internal Docker bridge interface to the loc
- 8.5 High severity
core: Improper Neutralization of Input During Web Page Generation
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript c
- 7.0 High severity
core: Improper Verification of Source of a Communication Channel
Home Assistant Core is an open source home automation that puts local control and privacy first. Affected versions are subject to a potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party lib
- 8.8 High severity
core: Cross-Site Request Forgery
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. Attackers may send malicious links/QRs to victims that, when visited, will make the victim to call arbitrary services in their Home Assistant
- 7.2 High severity
core: Server-Side Request Forgery
Home assistant is an open source home automation. In affected versions the `hassio.addon_stdin` is vulnerable to a partial Server-Side Request Forgery where an attacker capable of calling this service (e.g.: through GHSA-h2jp-7grc-9xpp) may be able to invoke a
- 7.8 High severity
core: Improper Control of Generation of Code
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited nati
- 9.6 Critical severity
core: Improper Restriction of Rendered UI Layers or Frames
Home assistant is an open source home automation. Home Assistant server does not set any HTTP security headers, including the X-Frame-Options header, which specifies whether the web page is allowed to be framed. The omission of this and correlating headers fac
- 9.0 Critical severity
core: Insufficient Verification of Data Authenticity
Home assistant is an open source home automation. Whilst auditing the frontend code to identify hidden parameters, Cure53 detected `auth_callback=1`, which is leveraged by the WebSocket authentication logic in tandem with the `state` parameter. The state param
- 9.6 Critical severity
core: Improper Neutralization of Input During Web Page Generation
Home assistant is an open source home automation. The Home Assistant login page allows users to use their local Home Assistant credentials and log in to another website that specifies the `redirect_uri` and `client_id` parameters. Although the `redirect_uri` v
- 10.0 Critical severity
core: Improper Authentication
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Sup