VULNERABILITY INTELLIGENCE

CVE-2023-41898

CVSS score8.6 HIGH
EPSS probability0.18%
CISA KEVNot currently listed
Published2023-10-19
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Description

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

Weakness classification

  • security-advisories@github.com: CWE-94
  • nvd@nist.gov: CWE-94

Primary references