Home Assistant vulnerabilities and fixes

CVEs that mention Home Assistant, ranked by priority. 13 tracked.

Home Assistant has 13 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2026-08-18. Highest priority: CVE-2026-64825 (score 49/100).

• CVE-2026-64825 CRITICAL 9.3 Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attack
• CVE-2026-72581 HIGH 8.6 A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remot
• CVE-2026-64824 HIGH 8.4 Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function tha
• CVE-2026-53455 HIGH 8.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-53453 HIGH 8.7 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-53454 MEDIUM 6.9 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-53457 MEDIUM 5.1 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-53458 MEDIUM 5.3 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-66060 HIGH 7.1 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-66061 HIGH 7.1 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-59717 MEDIUM 4.3 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-53456 MEDIUM 5.6 Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files
• CVE-2026-64823 MEDIUM 4.7 Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's

FAQ

How do I fix Home Assistant vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Home Assistant being exploited right now?

None of the tracked Home Assistant CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Home Assistant CVE should I patch first?

CVE-2026-64825 currently ranks highest (49/100): Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attack.

← Back to latest CVEs