Harish Kolla

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's async get media image() method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. Attackers can cause the media player proxy endpoint to serve attacker-controlled bytes with Content-Type text/html in the Home Assistant web origin, enabling theft of session tokens from local storage and authenticated calls to sensitive service endpoints including lock, alarm, and cover controls.

**Name of the Vulnerable Software and Affected Versions** Home Assistant Core versions prior to 2026.7.0 **Description** A path traversal issue exists in the backup-restore function. An attacker can write files to arbitrary absolute filesystem paths by providing a specially crafted tar archive. This is achieved using a SYMTYPE entry that pairs a benign member name with an absolute linkname pointing outside the extraction directory. Since the official Docker image executes the Home Assistant process as root, the subsequent regular-file entry is written through the unvalidated symlink. This can lead to remote code execution by overwriting auto-imported Python paths, such as `site-packages/sitecustomize.py`, or custom component directories. **Recommendations** Update Home Assistant Core to version 2026.7.0 or later.

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path. truediv to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.

**Name of the Vulnerable Software and Affected Versions** OpenClaw versions prior to 2026.5.28 **Description** A credential exposure issue exists where workspace dotenv files can override provider credentials. This allows attackers with lower-trust access to configured input paths to expose sensitive data and credentials that are intended to remain within trusted boundaries. **Recommendations** Update to version 2026.5.28.