Skip to content
OpenAdvisories

Package · PyPI

homeassistant

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 5.4
    CVE-2026-91129

    Home Assistant: mDNS Server-Side Request Forgery

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in homeassistant/components/ipp/config_flow.py, wher…

    home-assistant core homeassistant PyPI
  • Medium 4.0
    CVE-2025-65713

    Home Assistant Core before is vulnerable to Directory Traversal

    Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integration does not fully validate file paths during concatenation, leaving a path traversal vulnerability.

    homeassistant PyPI
  • Medium 4.3
    CVE-2023-50715

    User accounts disclosed to unauthenticated actors on the LAN

    Home Assistant is open source home automation software. Prior to version 2023.12.3, the login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. Version 2023.12.3 contains a patch for this is…

    home-assistant core homeassistant PyPI
  • Medium 4.3
    CVE-2023-41893

    Account takeover via auth_callback login in Home Assistant Core

    Home assistant is an open source home automation. The audit team’s analyses confirmed that the `redirect_uri` and `client_id` are alterable when logging in. Consequently, the code parameter utilized to fetch the `access_token` post-authentication will be sent…

    home-assistant core homeassistant PyPI