---
id: CVE-2026-64823
title: Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI
summary: >-
  Home Assistant Core before 2026.5.4 contains a cross-site scripting
  vulnerability in the Shelly integration's async_get_media_image() method that
  allows attackers controlling a Shelly device's thumb field to serve arbitrary
  HTML content …
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: home-assistant
product: Home Assistant Core
affected:
  - home_assistant_core < 2026.5.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-22T14:12:03.484754Z'
published: '2026-07-21'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:59.946Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64823'
references:
  - url: 'https://github.com/home-assistant/core/releases/tag/2026.5.4'
    label: Home Assistant Core 2026.5.4 Release Notes
  - url: 'https://github.com/home-assistant/core/pull/171585'
    label: Pull Request
  - url: >-
      https://github.com/home-assistant/core/commit/894a68acb678afc382fe5ea9002e61ab7f862011
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/home-assistant-core-xss-via-shelly-media-player-py-thumb-uri
tags:
  - cve.org
epss: 0.00296
epssPercentile: 0.22369
ingestedAt: '2026-11-08T14:51:22.269Z'
---

## Overview

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async_get_media_image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

## Affected

- `home_assistant_core < 2026.5.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.