1. Home
  2. CVE Database
  3. CVE-2026-33044
MEDIUM · 5.4

CVE-2026-33044

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious n...

Vulnerability Description

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.

CVSS Score

5.4

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
Home-AssistantHome-Assistant>= 2020.02, < 2026.1.0

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2026-33044?

CVE-2026-33044 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious n...

How severe is CVE-2026-33044?

CVE-2026-33044 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-33044?

Check the references section above for vendor advisories and patch information. Affected products include: Home-Assistant Home-Assistant.