CVE-2021-29448 Stored DOM XSS in Pi-hole Admin Web Interface
An attacker with network access to the DNS server can inject malicious scripts into the Pi-hole Admin portal, potentially compromising administrator sessions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-29448?
CVE-2021-29448 is a high-severity cross-site scripting vulnerability in pi-hole AdminLTE, published on 15 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
Weakness: CWE-79
Which versions are affected by CVE-2021-29448?
It affects 3 products.
Products include Pi-Hole Ftldns, Pi-Hole Pi-Hole, Pi-Hole Web Interface.
How do I fix CVE-2021-29448?
No fix has been published for CVE-2021-29448 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-29448 being exploited?
There is no known exploitation of CVE-2021-29448 in the wild and no public exploit code.
Other vulnerabilities in pi-hole AdminLTE
- CVE-2026-35517 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection
- CVE-2026-35518 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.cnameRecords Newline Injection
- CVE-2026-35519 Pi-hole FTL affected by Remote Code Execution (RCE) via dns.hostRecord Newline Injection
- CVE-2026-35520 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.leaseTime Newline Injection
- CVE-2026-35521 Pi-hole FTL affected by Remote Code Execution (RCE) via dhcp.hosts Newline Injection
Sources
Also known as GHSA-cwwf-93p7-73j9.