CVE-2026-64823 | Home Assistant Core before 2026.5.4 contains a cross-site sc… | CVSS 4.7 MEDIUM

Description

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

Metadata

CVE ID: CVE-2026-64823
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-07-20 18:27 UTC
Published: 2026-07-21 15:16 UTC
Last updated: 2026-07-21 15:16 UTC
Primary CWE: CWE-79
Improper Neutralization of Input During Web Page Generation …
Vendor / Product: home-assistant / Home Assistant Core
Sources: cve.org · NVD

Severity & Metrics

4.7 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products (1)

Vendor	Product	Platform	Versions
home-assistant	Home Assistant Core	—	0 < 2026.5.4

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS scores (2)

Score	Severity	Version	Source	Vector
4.7	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
2.1	LOW	4.0	cna	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References (4)