CVE-2026-33405

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.6 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/pi-hole/web/security/advisories/GHSA-jx8x-mj2r-62vq	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Pi-hole Admin Interface es una interfaz web para gestionar Pi-hole, una aplicación de bloqueo de anuncios y rastreadores de internet a nivel de red. Desde la versión 6.0 hasta antes de la 6.5, la función formatInfo() en queries.js renderiza data.upstream, data.cliente.ip y data.ede.text en HTML sin escapar cuando un usuario expande una fila de consulta en el Registro de Consultas, lo que permite la inyección de HTML almacenado. La ejecución de JavaScript está bloqueada por la CSP del servidor (script-src ’self’). Los mismos campos se escapan correctamente en la vista de tabla (rowCallback), lo que confirma que la omisión fue un descuido. Esta vulnerabilidad se corrige en la versión 6.5.

Information

Published : 2026-04-06 16:16

Updated : 2026-10-26 22:10

NVD link : CVE-2026-33405

Mitre link : CVE-2026-33405

CVE.ORG link : CVE-2026-33405

JSON object : View

Products Affected

pi-hole

web_interface

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-33405", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33405", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T18:37:34.520924Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 0.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pi-hole", "product": "web", "versions": [{"status": "affected", "version": ">= 6.0, < 6.5"}]}]}], "published": "2026-04-06T16:16:33.610", "references": [{"url": "https://github.com/pi-hole/web/security/advisories/GHSA-jx8x-mj2r-62vq", "tags": ["Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5."}, {"lang": "es", "value": "Pi-hole Admin Interface es una interfaz web para gestionar Pi-hole, una aplicaci\u00f3n de bloqueo de anuncios y rastreadores de internet a nivel de red. Desde la versi\u00f3n 6.0 hasta antes de la 6.5, la funci\u00f3n formatInfo() en queries.js renderiza data.upstream, data.cliente.ip y data.ede.text en HTML sin escapar cuando un usuario expande una fila de consulta en el Registro de Consultas, lo que permite la inyecci\u00f3n de HTML almacenado. La ejecuci\u00f3n de JavaScript est\u00e1 bloqueada por la CSP del servidor (script-src \u2019self\u2019). Los mismos campos se escapan correctamente en la vista de tabla (rowCallback), lo que confirma que la omisi\u00f3n fue un descuido. Esta vulnerabilidad se corrige en la versi\u00f3n 6.5."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3F1EA9FF-4B56-41DE-A685-A1B75E6ECEF2", "versionEndIncluding": "6.4.1", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}