CVE-2026-64823: Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Home Assistant Coreto a version that resolves this vulnerability.Fixed in 2026.5.4Patch XSS via Shelly media_player.py thumb URI
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64823?
CVE-2026-64823 has a severity rating of medium with a CVSS score of 4.7.
How do I fix CVE-2026-64823?
To fix CVE-2026-64823, upgrade your Home Assistant Core to version 2026.5.4 or later.
What type of vulnerability is CVE-2026-64823?
CVE-2026-64823 is a cross-site scripting (XSS) vulnerability.
Which software is affected by CVE-2026-64823?
CVE-2026-64823 affects Home Assistant Core versions prior to 2026.5.4.
What component of Home Assistant is involved in CVE-2026-64823?
CVE-2026-64823 involves the Shelly integration's async_get_media_image() method.