CVE-2026-33044
Medium
Description
Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.
SeverityMedium
CVSS5.4
Exploit probability—
ProductHome-assistant
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- home-assistant home-assistant2026.1.0 or later
- homeassistant2026.01 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| home-assistant home-assistant | 2020.02 ≤ v < 2026.1.0 | 2026.1.0 |
| homeassistantPyPI | 2020.02 ≤ v < 2026.01 | 2026.01 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.