CVE-2026-33045 Home Assistant has stored XSS in history-graphs
An attacker can inject malicious scripts via mobile phone sensor data in Home Assistant, potentially leading to code execution or account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-33045?
CVE-2026-33045 is a high-severity cross-site scripting vulnerability in home-assistant core, published on 27 Mar 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. Version 2026.01 fixes the issue.
Weakness: CWE-79
Which versions are affected by CVE-2026-33045?
3 open source packages ship an affected version, including homeassistant. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
homeassistant PyPI | From 2025.02 | 2026.01 |
homeassistant PyPI | From 2025.02 | 2026.01 |
homeassistant PyPI | From 2025.02 | 2026.01 |
Products include Home-Assistant Home-Assistant.
How do I fix CVE-2026-33045?
Upgrade homeassistant to 2026.01 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-33045 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33045 exists.
Other vulnerabilities in home-assistant core
- CVE-2023-27482 Auth bypass in core
- CVE-2023-41895 Cross-site Scripting via auth_callback login in Home Assistant Core
- CVE-2023-41897 Lack of XFO header allows clickjacking in Home Assistant Core
- CVE-2026-54317 Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
- CVE-2020-36517 Information disclosure in n/a
Sources
Also known as GHSA-46j8-vpx8-6p72, PYSEC-2026-2516.