# CVE-2026-33044: PYSEC-2026-2517 - Home Assistant has stored XSS in Map-card through malicious device name

Source: https://junglewise.ai/threats/cve-2026-33044-home-assistant-has-stored-xss-in-map-card-through-malicious  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27  
License: CC BY 4.0 with a link back

CVE-2026-33044 · Severity: medium · CVSS 5.4 · Published 2026-03-27

Home Assistant is open source home automation software that puts local control and privacy first. Starting in version 2020.02 and prior to version 2026.01, an authenticated party can add a malicious name to their device entity, allowing for Cross-Site Scripting attacks against anyone who can see a dashboard with a Map-card which includes that entity. It requires that the victim hovers over an information point. Version 2026.01 fixes the issue.

Technologies: [Home Assistant Home-Assistant](https://junglewise.ai/threats/technologies/home-assistant), [homeassistant (PyPI)](https://junglewise.ai/threats/technologies/homeassistant). Vendors: [Home Assistant](https://junglewise.ai/threats/vendors/home-assistant), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33044 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33044 being exploited in the wild.

**How severe is CVE-2026-33044?** Medium severity, with a CVSS score of 5.4, published 27 March 2026.

**Which products and versions are affected?** homeassistant (PyPI) ECOSYSTEM:introduced=2020.02,fixed=2026.01.

**Is there a fix for CVE-2026-33044?** Yes. homeassistant (PyPI): upgrade to 2026.01 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-33044?** Check whether you run Home Assistant Home-Assistant or homeassistant (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- homeassistant (PyPI): upgrade to 2026.01 or later

  ```sh
  pip install "homeassistant>=2026.01"
  ```


## Affected products

- Home Assistant Home-Assistant
- homeassistant (PyPI) ECOSYSTEM:introduced=2020.02,fixed=2026.01

## Identifiers

- CVE-2026-33044
- GHSA-r584-6283-p7xc
- PYSEC-2026-2517

## Related threats

- [Home Assistant Statistics Graph Card XSS via entity names](https://junglewise.ai/threats/cve-2026-91130-home-assistant-statistics-graph-card-xss-via-entity-names)
- [Home Assistant Server-Side Request Forgery in mDNS IPP integration](https://junglewise.ai/threats/cve-2026-91129-home-assistant-server-side-request-forgery-in-mdns-ipp)
- [Home Assistant Core path traversal in backup upload](https://junglewise.ai/threats/cve-2026-64825-home-assistant-core-path-traversal-in-backup-upload)
- [PYSEC-2026-1452 - Home Assistant does not correctly validate SSL for outgoing requests in core and used libs](https://junglewise.ai/threats/cve-2025-25305-home-assistant-does-not-correctly-validate-ssl-for-outgoing)
- [PYSEC-2026-1451 - User accounts disclosed to unauthenticated actors on the LAN](https://junglewise.ai/threats/cve-2023-50715-user-accounts-disclosed-to-unauthenticated-actors-on-the-lan)