# homeassistant (PyPI) vulnerabilities 12 known vulnerabilities (2 critical, 5 high, 4 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 2026.11.0 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 2026.11.0 (Nov 4, 2026), the latest release - Weekly downloads: 313.7K - Dependents: 6 - Releases: 500+ since 2023.9.2 (Sep 13, 2023) - Registry: https://pypi.org/project/homeassistant/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-91129: 2023.9.2 to 2026.2.2 (2026.2.3 is outside it) - CVE-2026-91130: 2023.9.2 to 2026.7.0b4 (2026.7.0 is outside it) - CVE-2026-64825: 2023.9.2 to 2026.6.0b4 (2026.6.0 is outside it) - CVE-2026-54317: 2023.9.2 to 2026.6.0b4 (2026.6.0 is outside it) - CVE-2026-33045: 2025.2.0 to 2026.1.0b5 (2026.1.0 is outside it) - CVE-2026-33044: 2023.9.2 to 2026.1.0b5 (2026.1.0 is outside it) - CVE-2025-65713: 2023.9.2 to 2025.8.0b5 (2025.8.0 is outside it) - CVE-2025-62172: 2025.1.0 to 2025.10.1 (2025.10.2 is outside it) - CVE-2025-25305: 2023.9.2 to 2024.1.5 (2024.1.6 is outside it) - CVE-2023-50715: 2023.9.2 to 2023.12.2 (2023.12.3 is outside it) - CVE-2023-41893: no published release is affected - CVE-2018-21019: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (12) ### [CVE-2026-91129](https://cve.now/CVE-2026-91129): Home Assistant: mDNS Server-Side Request Forgery - Severity: Medium 5.4 - Published: Sep 22, 2026 - Affected: fixed in 2026.2.3. - Fixed in 2026.2.3 (released Feb 20, 2026, 214 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2026-91130](https://cve.now/CVE-2026-91130): Home Assistant: XSS in Statistics Graph Card - Severity: Critical 9.3 - Published: Sep 22, 2026 - Affected: fixed in 2026.7.0. - Fixed in 2026.7.0 (released Jul 1, 2026, 83 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2026-64825](https://cve.now/CVE-2026-64825): Home Assistant Core \< 2026.6.0 Path Traversal File Write via Backup Upload - Severity: Critical 9.0 - Published: Jul 21, 2026 - Affected: fixed in 2026.6.0. - Fixed in 2026.6.0 (released Jun 3, 2026, 48 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2026-54317](https://cve.now/CVE-2026-54317): Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN - Severity: High 7.6 - Published: Jun 23, 2026 - Affected: fixed in 2026.6.0. - Fixed in 2026.6.0 (released Jun 3, 2026, 20 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2026-33045](https://cve.now/CVE-2026-33045): Home Assistant has stored XSS in history-graphs - Severity: High 7.3 - Published: Mar 27, 2026 - Affected: from 2025.02, fixed in 2026.01. - Fixed in 2026.1.0 (released Jan 7, 2026, 79 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2026-33044](https://cve.now/CVE-2026-33044): Home Assistant has stored XSS in Map-card through malicious device name - Severity: High 7.3 - Published: Mar 27, 2026 - Affected: from 2020.02, fixed in 2026.01. - Fixed in 2026.1.0 (released Jan 7, 2026, 79 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2025-65713](https://cve.now/CVE-2025-65713): Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. - Severity: Medium 4.0 - Published: Dec 23, 2025 - Affected: fixed in 2025.8.0. - Fixed in 2025.8.0 (released Aug 6, 2025, 139 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2025-62172](https://cve.now/CVE-2025-62172): Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name - Severity: High 8.5 - Published: Oct 14, 2025 - Affected: from 2025.1.0, fixed in 2025.10.2. - Fixed in 2025.10.2 (released Oct 10, 2025, 4 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2025-25305](https://cve.now/CVE-2025-25305): SSL validation for outgoing requests in Home Assistant Core and used libs not correct - Severity: High 7.0 - Published: Feb 18, 2025 - Affected: fixed in 2024.1.6. - Fixed in 2024.1.6 (released Jan 31, 2024, 384 days before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2023-50715](https://cve.now/CVE-2023-50715): User accounts disclosed to unauthenticated actors on the LAN - Severity: Medium 4.3 - Published: Dec 15, 2023 - Affected: fixed in 2023.12.3. - Fixed in 2023.12.3 (released Dec 14, 2023, 1 day before disclosure). - The latest release, 2026.11.0, is not affected. ### [CVE-2023-41893](https://cve.now/CVE-2023-41893): Account takeover via auth\_callback login in Home Assistant Core - Severity: Medium 4.3 - Published: Oct 19, 2023 - Affected: fixed in 2023.9.0. - Fixed in 2023.9.0. - The latest release, 2026.11.0, is not affected. ### [CVE-2018-21019](https://cve.now/CVE-2018-21019): Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the… - Severity: Unrated - Published: Sep 23, 2019 - Affected: fixed in 0.67.0. - Fixed in 0.67.0. - The latest release, 2026.11.0, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/homeassistant Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.