CVE-2026-33045
Last modified
CVE-2026-33045 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2025.02 and prior to version 2026.01 the "remaining charge time"-sensor for mobile phones (imported/included from Android Auto it appears) is vulnerable cross-site scripting, similar to CVE-2025-62172. Version 2026.01 fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Home-Assistant | Home-Assistant | >= 2025.2.0, < 2026.1.0 |
References
- https://github.com/home-assistant/core/security/advisories/GHSA-46j8-vpx8-6p72Exploit, Vendor Advisory
- https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285mExploit, Vendor Advisory
- https://github.com/home-assistant/core/security/advisories/GHSA-46j8-vpx8-6p72Exploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2026-33045?
How severe is CVE-2026-33045?
How do I fix CVE-2026-33045?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-3304Multer is a node.js middleware for handling `multipart/form-…7.5
- CVE-2026-33040libp2p-rust is the official rust language Implementation of …7.5
- CVE-2026-33041WWBN AVideo is an open source video platform. In versions 25…5.3
- CVE-2026-33042Parse Server is an open source backend that can be deployed …5.3
- CVE-2026-33043WWBN AVideo is an open source video platform. In versions 25…8.1
- CVE-2026-33044Home Assistant is open source home automation software that …5.4
- CVE-2026-33046Indico is an event management system that uses Flask-Multipa…8.8
- CVE-2026-33051Craft CMS is a content management system (CMS). In versions …5.4
- CVE-2026-33052Mantis Bug Tracker (MantisBT) is an open source issue tracke…5.3
- CVE-2026-33053Langflow is a tool for building and deploying AI-powered age…8.8
- CVE-2026-33054Mesop is a Python-based UI framework that allows users to bu…9.8
- CVE-2026-33055tar-rs is a tar archive reading/writing library for Rust. Ve…8.1
Are you affected by CVE-2026-33045?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST