These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-91129 is a medium-severity vulnerability affecting Home Assistant, an open-source home automation software. The issue arises from the IPP integration's automatic processing of unauthenticated mDNS announcements, allowing a local-network attacker to redirect requests to internal services without user interaction. This vulnerability can be exploited by a local-network attacker to potentially gain u [truncated]
The Home Assistant iOS Companion app vulnerability (CVE-2026-66061) allows silent automation execution by untrusted apps. Affected users should verify and apply the fixed version 2026.5.0, restrict access, and monitor for suspicious activity. This issue involves the iOS Companion app treating tag links delivered through OS-level routing mechanisms like universal links as if they were physically scanned, w [truncated]
Home Assistant, an open-source home automation software, had a vulnerability prior to version 2026.5.3. The Companion app could be exploited by any untrusted app on the device to execute automations silently without user interaction, by forwarding arbitrary tag links. This issue is fixed in version 2026.8.1. The vulnerability allows untrusted local apps to execute Home Assistant automations silently, requ [truncated]
Home Assistant's Android Companion app, prior to version 2026.6.1, is vulnerable to an open redirect. This issue allows an attacker to craft a malicious invite that could redirect users to a phishing page, potentially capturing their credentials. The vulnerability is due to the app passing the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination [truncated]
CVE-2026-64823 is a cross-site scripting vulnerability in Home Assistant Core before version 2026.5.4. The vulnerability exists in the Shelly integration's async_get_media_image() method, which allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without validation against an image-only allowlist. This vulnerabilit [truncated]
Home Assistant Core before version 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. This vulnerability can be exploited by manipulating the 'name' field inside the uploaded archive's backup.json to supply an absolute path, potent [truncated]
## Summary Home Assistant Companion apps for Android (prior to 2026.4.4) and iOS (prior to 2026.4.1) contain a cross-origin JavaScript bridge exposure vulnerability. The apps expose native bridge objects (`window.externalApp` on Android; `webkit.messageHandlers.getExternalAuth`, `revokeExternalAuth`, and `externalBus` on iOS) to all frames within the in-app WebView, including cross-origin iframes. Combine [truncated]
