CVE-2023-41898
High
Description
Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.
SeverityHigh
CVSS8.6
Exploit probability—
ProductHome-assistant Home Assistant Companion
PublishedOct 19, 2023
First seenOct 19, 2023
Weakness typeCWE-345CWE-345CWE-94Code injection
How to fix
Update
- home-assistant home_assistant_companion2023.9.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| home-assistant home_assistant_companion | v < 2023.9.2 | 2023.9.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.