CVE-2026-33404

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-33404

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33404.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-33404

Aliases

GHSA-px6w-85wp-ww9v

Published

2026-04-06T14:48:45.348Z

Modified

2026-07-15T01:49:08.845406098Z

Severity

3.4 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N CVSS Calculator

Summary

Pi-hole has a Stored XSS / HTML injection in the Network page/Dashboard

Details

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, client hostnames and IP addresses from the FTL database are rendered into the DOM without escaping in network.js (Network page) and charts.js/index.js (Dashboard chart tooltips). While upstream validation in dnsmasq and FTL blocks HTML characters via normal DHCP/DNS paths, the web UI performs no output escaping — an inconsistency with other fields in the same file that are properly escaped. This vulnerability is fixed in 6.5.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33404.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/pi-hole/web

Affected ranges

Type

GIT

Repo

https://github.com/pi-hole/web

Events

Introduced

a66d859aecb427faad6adfce144fd97fbeb26a13

Fixed

7a17e01c28eeb7af2c43384eccf5d859e3061371

Database specific

{
    "cpe": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "6.0"
        },
        {
            "fixed": "6.5"
        },
        {
            "last_affected": "6.4.1"
        }
    ]
}

Affected versions

v6.*

v6.0

v6.0.1

v6.0.2

v6.1

v6.2.1

v6.3

v6.4

v6.4.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-33404.json"