PyPI/homeassistant CVE-2026-33044: unknown, EPSS 0.29%

Home Assistant has stored XSS in Map-card through malicious device name

Action: Upgrade homeassistant to 2026.01 or later.

pip install homeassistant==2026.01

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2517
• https://github.com/home-assistant/core/security/advisories/GHSA-r584-6283-p7xc
• https://nvd.nist.gov/vuln/detail/CVE-2026-33044
• https://github.com/home-assistant/core
• https://pypi.org/project/homeassistant
• https://github.com/advisories/GHSA-r584-6283-p7xc

CVE-2026-33044 · published 2026-07-13T14:36:45.660731Z · modified 2026-07-13T16:31:57.325175190Z · JSON