CVE-2026-64823 in Home Assistant Core
Summary
by MITRE • 07/21/2026
Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within Home Assistant Core versions prior to 2026.5.4 and specifically affects the Shelly integration's async_get_media_image() method. The flaw represents a cross-site scripting vulnerability that arises from insufficient input validation when processing media image requests from Shelly devices. Attackers who can compromise a Shelly device and control its thumb field parameter can craft malicious data URIs containing HTML content with text/html content type, bypassing the intended image-only allowlist validation. This weakness falls under CWE-79 which defines cross-site scripting vulnerabilities as a result of improper input validation and output encoding.
The technical implementation of this vulnerability allows attackers to manipulate the media player proxy endpoint to serve arbitrary HTML content with the text/html Content-Type header within the Home Assistant web origin context. This creates a dangerous situation where malicious HTML can execute within the same security boundaries as legitimate Home Assistant web applications. The proxy endpoint's failure to properly validate and sanitize the content type of incoming media data enables attackers to inject scriptable content that can interact with the browser's local storage mechanisms. When users interact with the media player interface, the attacker-controlled HTML executes in the context of the authenticated Home Assistant session.
The operational impact of this vulnerability is severe as it provides attackers with the ability to steal session tokens stored in local storage and perform authenticated calls to sensitive service endpoints. This includes access to critical home automation controls such as lock systems, alarm panels, and cover devices that can be manipulated through the exposed service endpoints. The attack chain allows for privilege escalation from device compromise to full home automation system control, potentially enabling unauthorized access to physical security systems and environmental controls within the home network.
Security mitigations for this vulnerability should focus on implementing strict content type validation within the Shelly integration's async_get_media_image() method. All media content must be validated against a comprehensive image-only allowlist that rejects any non-image content types including text/html, text/plain, and application/javascript. The fix should also include proper sanitization of all input parameters from external devices before processing, implementing Content Security Policy headers to prevent script execution, and ensuring that proxy endpoints enforce strict MIME type checking for media content. Organizations should also consider implementing network segmentation between IoT devices and home automation systems to limit the impact of device compromise. This vulnerability demonstrates the importance of validating all external input in IoT ecosystems and aligns with ATT&CK technique T1213 which covers data exploitation through web application vulnerabilities, emphasizing that such attacks often begin with compromising low-value IoT devices to gain access to higher-value systems within the home network infrastructure.
The security implications extend beyond immediate session theft to include potential for persistent access and lateral movement within home networks. Attackers can leverage stolen tokens to maintain long-term access to home automation systems while also potentially using the compromised Shelly device as a foothold for further attacks on other connected devices. The vulnerability underscores the critical need for input validation in IoT device integrations and represents a common pattern where insufficient sanitization of third-party device communications creates opportunities for sophisticated attacks against otherwise secure home automation platforms.