CVE-2026-64823: Home Assistant Core XSS Vulnerability

CVE-2026-64823 Overview

CVE-2026-64823 is a cross-site scripting vulnerability in Home Assistant Core versions before 2026.5.4. The flaw resides in the Shelly integration's async_get_media_image() method within homeassistant/components/shelly/media_player.py. An attacker who controls a Shelly device's thumb field can supply a data URI with a text/html content type, which the media player proxy endpoint then serves without validating against an image-only allowlist. This allows attacker-controlled bytes to be served with Content-Type: text/html under the Home Assistant web origin. The issue is classified as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Successful exploitation enables theft of session tokens from local storage and authenticated calls to sensitive service endpoints, including lock, alarm, and cover controls.

Affected Products

Home Assistant Core versions prior to 2026.5.4
Deployments with the Shelly integration enabled
Environments where a Shelly device (or emulated device) can be controlled by an attacker

Discovery Timeline

2026-07-21 - CVE-2026-64823 published to NVD
2026-07-22 - Last updated in NVD database
2026.5.4 - Home Assistant Core release containing the fix

Technical Details for CVE-2026-64823

Vulnerability Analysis

The Shelly integration exposes device thumbnail imagery through the media player proxy endpoint. The async_get_media_image() implementation in media_player.py retrieves the thumb value from the device and passes the referenced bytes and MIME type through to the browser. Because the endpoint did not restrict responses to image MIME types, any content type declared by the source (including text/html) was propagated verbatim.

When a browser fetches the proxied image URL, it renders the returned HTML in the Home Assistant origin. Any script contained in that HTML executes with access to localStorage, from which authentication tokens can be exfiltrated. With those tokens, the attacker can invoke privileged service endpoints such as lock.unlock, alarm_control_panel.alarm_disarm, and cover.open_cover.

Root Cause

The media player proxy accepted an arbitrary data URI from the Shelly device thumb field without enforcing an image-only MIME allowlist. Trusting device-supplied content type values produced a same-origin HTML injection primitive.

Attack Vector

The attack requires an attacker to control the thumb value of a Shelly device paired with the Home Assistant instance. This can occur by compromising a Shelly device on the network, by spoofing a Shelly device, or by tricking a user into pairing an attacker-operated device. User interaction is required to load the affected media image URL in an authenticated session.

python

# Patch excerpt from homeassistant/components/shelly/media_player.py
# Source: https://github.com/home-assistant/core/commit/894a68acb678afc382fe5ea9002e61ab7f862011

 import base64
 import binascii
+import contextlib
 from dataclasses import dataclass
 import datetime
 import hashlib

The fix in pull request home-assistant/core#171585 validates the MIME type of the thumb data URI and corrects media_image_hash, ensuring only image content types are served through the proxy endpoint.

Detection Methods for CVE-2026-64823

Indicators of Compromise

Media player proxy responses returning Content-Type: text/html originating from the Shelly integration.
Shelly device thumb fields containing data:text/html URIs or non-image MIME declarations.
Unexpected outbound requests from browsers authenticated to Home Assistant, particularly to attacker-controlled domains carrying Authorization or token-like query parameters.
Home Assistant service calls to lock, alarm_control_panel, or cover domains from sessions that do not match normal user activity patterns.

Detection Strategies

Inspect HTTP responses from the Home Assistant /api/media_player_proxy/ path and alert when the Content-Type header is not an image/* value.
Review Shelly device configuration data for thumb values that begin with data: and are not image MIME types.
Correlate authenticated API activity with the originating user session to identify service calls triggered outside expected UI workflows.

Monitoring Recommendations

Log and retain Home Assistant HTTP access logs for the media proxy endpoint, including response headers where possible.
Monitor Shelly integration entity attributes for changes to entity_picture or thumb fields.
Alert on Home Assistant releases and integration updates to ensure timely patch application across managed deployments.

How to Mitigate CVE-2026-64823

Immediate Actions Required

Upgrade Home Assistant Core to version 2026.5.4 or later, which contains the validated MIME type check.
Audit all paired Shelly devices for unexpected firmware or configuration and remove untrusted devices.
Rotate long-lived Home Assistant access tokens if unauthorized media proxy responses have been observed.

Patch Information

The fix is included in the Home Assistant Core 2026.5.4 release. The change is implemented in commit 894a68a via pull request #171585. Additional context is available in the VulnCheck advisory.

Workarounds

Disable the Shelly integration until the upgrade is applied if untrusted Shelly devices may be present.
Isolate Shelly devices on a segmented VLAN to reduce the chance of a compromised device supplying malicious thumb values.
Restrict browser access to the Home Assistant frontend to trusted networks while the patch is being deployed.

bash

# Upgrade Home Assistant Core (Home Assistant OS / Supervised)
ha core update --version 2026.5.4

# Verify installed version
ha core info | grep version