CVE-2026-33044

Home Assistant has stored XSS in Map-card through malicious device name

State: Published
Severity: 7.3 High
Published: Mar 27, 2026
Updated: Apr 2, 2026
Reserved: Mar 17, 2026

Description

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.

Scores

CVSS	Score	Vector	Source
4.0	7.3 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P	GitHub_M

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
corehome-assistant	>= 2020.02, < 2026.01Affected

References

https://github.com/home-assistant/core/security/advisories/GHSA-r584-6283-p7xc

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.