CVE-2023-41898

Arbitrary URL load in Android WebView in `MyActivity.kt` in Home Assistant Companion for Android

State: Published
Severity: 8.6 High
Published: Oct 19, 2023
Updated: Sep 12, 2024
Reserved: Sep 4, 2023

Description

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

Scores

CVSS	Score	Vector	Source
3.1	8.6 High	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity
CWE-94 Improper Control of Generation of Code ('Code Injection')

Affected Products

Product	Versions
corehome-assistant	< 2023.9.2Affected

References

https://github.com/home-assistant/core/security/advisories/GHSA-jvpm-q3hq-86rg

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.