Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

esphome

6 known vulnerabilities (4 high, 1 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 4 high, 1 medium, 1 low
Registry
PyPI

Advisories 6

  • ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

    Affected: from 2025.9.0, fixed in 2025.12.7.

  • ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

    Affected: fixed in 2025.8.1.

  • ESPHome vulnerable to Authentication bypass via Cross site request forgery

    Affected: from 2023.12.9, fixed in 2024.3.0.

  • CVE-2024-27287Medium 6.5

    ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

    Affected: from 2023.12.9, fixed in 2024.2.2.

  • ESPHome remote code execution via arbitrary file write

    Affected: from 2023.12.9, fixed in 2024.2.1.

  • web_server allows OTA update without checking user defined basic auth username & password

    Affected: fixed in 2021.9.2.