CVE-2026-11425: Domoticz Stored XSS Vulnerability

CVE-2026-11425 Overview

CVE-2026-11425 is a stored cross-site scripting (XSS) vulnerability in Domoticz home automation software versions prior to 2026.3. Authenticated attackers can inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders these values with ng-bind-html after applying only an nl2br() transform, which performs no HTML escaping. Stored payloads execute in an administrator's browser when the mobile dashboard is viewed, enabling session cookie theft and account takeover. The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated attackers can persist JavaScript payloads that execute in administrator sessions on the mobile dashboard, leading to cookie theft and account takeover.

Affected Products

Domoticz versions prior to 2026.3
Domoticz mobile dashboard component
Devices exposing Text or Alert subtypes through the Domoticz API

Discovery Timeline

2026-08-07 - CVE-2026-11425 published to the National Vulnerability Database
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2026-11425

Vulnerability Analysis

Domoticz stores device state values submitted through its API and renders those values in multiple dashboard views. The mobile dashboard binds device data directly to the DOM using AngularJS ng-bind-html. This directive inserts the bound expression as HTML rather than text, so any markup or script tags in the value become part of the rendered page.

An authenticated user with permission to update device values can supply a payload containing <script> tags, event handlers, or other executable HTML. When an administrator opens the mobile dashboard, the browser parses and executes the stored payload in the administrator's origin. Attackers can exfiltrate session cookies, issue authenticated API calls, or add persistent accounts.

Root Cause

The root cause is missing output encoding on user-controllable device data. The mobile dashboard passes device text through nl2br(), which only converts newline characters to <br> tags. It performs no HTML entity escaping. Combined with ng-bind-html, which bypasses AngularJS's default text-binding sanitization, the pipeline treats attacker-supplied content as trusted markup.

Attack Vector

Exploitation requires an authenticated session with sufficient privileges to update device values and user interaction from an administrator who subsequently loads the mobile dashboard. The attacker submits a crafted payload to the API endpoint that updates a Text or Alert subtype device. The malicious value persists in the Domoticz database and triggers on every subsequent render of the affected view.

text

// Patch reference from Domoticz commit f734fde31a4c2ecab3edd825ceb9854719444f64
// (build configuration excerpt from the release that includes the XSS fix)
option(BUILD_MASTER "Build the stable (master) channel: version string without build number" NO)

IF(BUILD_MASTER)
  add_definitions(-DBUILD_MASTER)
ENDIF()

Source: GitHub Commit f734fde. The full fix for the XSS is described in the VulnCheck Advisory for Domoticz.

Detection Methods for CVE-2026-11425

Indicators of Compromise

Device value fields for Text or Alert subtypes containing HTML tags such as <script>, <img onerror=, <svg onload=, or javascript: URIs
Outbound HTTP requests from administrator browsers to unfamiliar domains shortly after loading the mobile dashboard
Unexpected session cookies being transmitted to third-party hosts in browser or proxy logs
New administrative accounts or API tokens created without a corresponding operator action

Detection Strategies

Query the Domoticz DeviceStatus table and API for device values containing angle brackets, quotes, or JavaScript event-handler keywords.
Review web server access logs for type=command¶m=udevice, param=setused, or similar update endpoints that carry HTML-encoded payloads.
Inspect browser Content Security Policy (CSP) violation reports if CSP is enforced in front of Domoticz.

Monitoring Recommendations

Alert on any Domoticz API request whose body or query string contains <script, onerror=, onload=, or javascript: substrings.
Baseline the population of user accounts and API keys and alert on additions.
Log and review administrator dashboard access from unusual geolocations or IP ranges.

How to Mitigate CVE-2026-11425

Immediate Actions Required

Upgrade Domoticz to version 2026.3 or later on all instances.
Audit all Text and Alert subtype devices for stored payloads and reset any values containing HTML or script content.
Rotate administrator credentials and API tokens that may have been exposed to executed payloads.

Patch Information

The fix is included in Domoticz 2026.3. Reference the upstream repository at the GitHub Domoticz Repository and the merge that introduces the release changes in GitHub Commit f734fde. See the VulnCheck Advisory for Domoticz for advisory details.

Workarounds

Restrict which authenticated users can update device values, limiting write access to trusted operators only.
Place Domoticz behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts.
Avoid using the mobile dashboard view until patching, favoring views that render device values as text.
Sanitize existing device values by replacing entries containing <, >, or " with plain-text equivalents.

bash

# Example: back up the database and upgrade Domoticz to 2026.3 on Linux
sudo systemctl stop domoticz.service
cp /home/domoticz/domoticz.db /home/domoticz/domoticz.db.bak
# Install the 2026.3 release per the official Domoticz upgrade procedure
sudo systemctl start domoticz.service