CVE-2026-33044 Home Assistant has stored XSS in Map-card through malicious device name
An authenticated attacker can inject malicious scripts via device names, leading to XSS when victims view a Map-card dashboard.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33044?
CVE-2026-33044 is a high-severity cross-site scripting vulnerability in home-assistant core, published on 27 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-33044?
3 open source packages ship an affected version, including homeassistant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
homeassistant PyPI | From 2020.02 | 2026.01 |
homeassistant PyPI | From 2020.02 | 2026.01 |
homeassistant PyPI | From 2020.02 | 2026.01 |
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2026-33044?
Upgrade homeassistant to 2026.01 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33044 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33044 exists.
Other vulnerabilities in home-assistant core
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
Sources
Also known as GHSA-r584-6283-p7xc, PYSEC-2026-2517.