Executive brief
Home Assistant Core, a popular open-source home automation platform, is vulnerable to a security flaw in its integration with Shelly smart devices. An attacker who controls a Shelly device on the network can inject malicious code into the Home Assistant interface. If a user views the affected device in their dashboard, the attacker could steal login session tokens or perform unauthorized actions like unlocking doors, disabling alarms, or opening garage covers.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Home Assistant Core's Shelly integration within the `async_get_media_image()` method. The vulnerability arises because the media player proxy endpoint fails to validate the MIME type of data URIs provided in a device's 'thumb' field against an image-only allowlist. By supplying a data URI with a `text/html` content type, an attacker can cause the Home Assistant web origin to serve attacker-controlled HTML/JavaScript. This allows for the execution of malicious scripts in the context of an authenticated user's session, potentially leading to the theft of session tokens from local storage and the ability to make authenticated REST API calls to sensitive components like locks and alarms. The issue is fixed in version 2026.5.4 by implementing strict MIME type validation.
Affected products
- Home Assistant Home Assistant Core before 2026.5.4
Timeline
- 2026-05-20: patched: Fix committed to core repository
- 2026-05-22: advisory: Release 2026.5.4 published
- 2026-07-21: disclosed: CVE published to NVD