Executive brief
esphome vulnerable to stored Cross-site Scripting in edit configuration file API
Affected products
- PyPI esphome
Junglewise Threat Intelligence
CVE-2024-27287: PYSEC-2026-1329 - esphome vulnerable to stored Cross-site Scripting in edit configuration file API
CVE-2024-27287 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: esphome (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-1326 - ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
- PYSEC-2026-1330 - ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
- PYSEC-2026-1327 - ESPHome vulnerable to Authentication bypass via Cross site request forgery
- PYSEC-2026-1328 - ESPHome vulnerable to remote code execution via arbitrary file write
- PYSEC-2021-351 - ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older