PyPI/esphome CVE-2024-29019: high 8.1, EPSS 0.27%

ESPHome vulnerable to Authentication bypass via Cross site request forgery

Action: Upgrade esphome to 2024.3.0 or later.

pip install esphome==2024.3.0

Affected

Fixed versions

Sources

• osv: GHSA-5925-88xh-6h99
• https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99
• https://nvd.nist.gov/vuln/detail/CVE-2024-29019
• https://github.com/esphome/esphome/pull/6396
• https://github.com/esphome/esphome/pull/6397
• https://github.com/esphome/esphome/commit/c56c40cb824e34ed2b89ba1cb8a3a5eb31459c74
• https://github.com/advisories/GHSA-9p43-hj5j-96h5
• https://github.com/esphome/esphome
• https://github.com/esphome/esphome/releases/tag/2024.3.0

CVE-2024-29019 · published 2024-03-21T16:26:35Z · modified 2026-07-07T17:57:28.638511916Z · JSON