CVE-2017-16782: Home-Assistant

Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days.

In Home Assistant before 0.57, it is possible to inject JavaScript code into a persistent notification via crafted Markdown text, aka XSS.

Affected products

• Home-Assistant Home-Assistant: up to and including 0.56.2

Published 2017-11-10. Last modified 2026-06-17.