CVE-2026-26952

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26952", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-16T22:20:28.611Z", "datePublished": "2026-02-19T22:43:58.403Z", "dateUpdated": "2026-02-20T15:40:28.882Z"}, "containers": {"cna": {"title": "Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp"}, {"name": "https://github.com/pi-hole/web/commit/d328f143718022d82dc94c8751121ca41be3b996", "tags": ["x_refsource_MISC"], "url": "https://github.com/pi-hole/web/commit/d328f143718022d82dc94c8751121ca41be3b996"}, {"name": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/pi-hole/web/releases/tag/v6.4.1"}], "affected": [{"vendor": "pi-hole", "product": "web", "versions": [{"version": "< 6.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T22:43:58.403Z"}, "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. The populateDataTable() function contains a data variable with the full DNS record value exactly as entered by the user and returned by the API. This value is inserted directly into the data-tag HTML attribute without any escaping or sanitization of special characters. When an attacker supplies a value containing double quotes (\"), they can prematurely \u201cclose\u201d the data-tag attribute and inject additional HTML attributes into the element. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited. This issue has been fixed in version 6.4.1."}], "source": {"advisory": "GHSA-6xp4-jw73-f4qp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:27:22.367629Z", "id": "CVE-2026-26952", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:40:28.882Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26952", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:27:22.367629Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:27:23.987Z"}}], "cna": {"title": "Pi-hole Web Interface has Stored HTML Injection via Local DNS Records (CNAME/Hosts) in data-tag Attribute", "source": {"advisory": "GHSA-6xp4-jw73-f4qp", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "pi-hole", "product": "web", "versions": [{"status": "affected", "version": "< 6.4.1"}]}], "references": [{"url": "https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp", "name": "https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pi-hole/web/commit/d328f143718022d82dc94c8751121ca41be3b996", "name": "https://github.com/pi-hole/web/commit/d328f143718022d82dc94c8751121ca41be3b996", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "name": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. The populateDataTable() function contains a data variable with the full DNS record value exactly as entered by the user and returned by the API. This value is inserted directly into the data-tag HTML attribute without any escaping or sanitization of special characters. When an attacker supplies a value containing double quotes (\"), they can prematurely \u201cclose\u201d the data-tag attribute and inject additional HTML attributes into the element. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited. This issue has been fixed in version 6.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T22:43:58.403Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26952", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:40:28.882Z", "dateReserved": "2026-02-16T22:20:28.611Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T22:43:58.403Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "web", "vendor": "pi-hole", "versions": [{"status": "affected", "version": "< 6.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "0BC7CDAC-AB62-4F32-B3C5-34AC7EE1953F", "versionEndExcluding": "6.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.4 and below are vulnerable to stored HTML injection through the local DNS records configuration page, which allows an authenticated administrator to inject code that is stored in the Pi-hole configuration and rendered every time the DNS records table is viewed. The populateDataTable() function contains a data variable with the full DNS record value exactly as entered by the user and returned by the API. This value is inserted directly into the data-tag HTML attribute without any escaping or sanitization of special characters. When an attacker supplies a value containing double quotes (\"), they can prematurely \u201cclose\u201d the data-tag attribute and inject additional HTML attributes into the element. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited. This issue has been fixed in version 6.4.1."}, {"lang": "es", "value": "La Interfaz de administraci\u00f3n de Pi-hole es una interfaz web para gestionar Pi-hole, una aplicaci\u00f3n de bloqueo de anuncios y rastreadores de internet a nivel de red. Las versiones 6.4 e inferiores son vulnerables a la inyecci\u00f3n de HTML almacenado a trav\u00e9s de la p\u00e1gina de configuraci\u00f3n de registros DNS locales, lo que permite a un administrador autenticado inyectar c\u00f3digo que se almacena en la configuraci\u00f3n de Pi-hole y se renderiza cada vez que se visualiza la tabla de registros DNS. La funci\u00f3n populateDataTable() contiene una variable de datos con el valor completo del registro DNS exactamente como lo introdujo el usuario y devuelto por la API. Este valor se inserta directamente en el atributo HTML data-tag sin ning\u00fan escape o sanitizaci\u00f3n de caracteres especiales. Cuando un atacante proporciona un valor que contiene comillas dobles (\"), pueden 'cerrar' prematuramente el atributo data-tag e inyectar atributos HTML adicionales en el elemento. Dado que Pi-hole implementa una Pol\u00edtica de Seguridad de Contenido (CSP) que bloquea JavaScript en l\u00ednea, el impacto es limitado. Este problema ha sido solucionado en la versi\u00f3n 6.4.1."}], "id": "CVE-2026-26952", "lastModified": "2026-06-17T10:26:26.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26952", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:27:22.367629Z", "version": "2.0.3"}}]}, "published": "2026-02-19T23:16:26.243", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pi-hole/web/commit/d328f143718022d82dc94c8751121ca41be3b996"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/pi-hole/web/releases/tag/v6.4.1"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/pi-hole/web/security/advisories/GHSA-6xp4-jw73-f4qp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "web", "source": "cna", "vendor": "pi-hole"}, "product": "web", "vendor": "pi-hole"}], "analysis": {"en": {"generated_at": "2026-04-18T11:41:25.775606+00:00", "value": {"mitigation_remediation": ["Upgrade Pi\u2011hole to version\u202f6.4.1 or later, which removes the unsanitized data\u2011tag insertion.", "If an upgrade cannot be performed immediately, restrict or disable the ability to edit local DNS records for administrators until the update is applied.", "Subscribe to Pi\u2011hole security advisories and apply any subsequent patches promptly."], "summary": {"action": "Patch", "impact": "Stored HTML Injection"}, "threat_synthesis": {"affected_systems": "All Pi\u2011hole Web Interface deployments running version\u202f6.4 or earlier are vulnerable. The vulnerability requires administrative authentication and is typically limited to users on the local network that can manage Pi\u2011hole through its web interface.", "description_and_impact": "Pi\u2011hole Admin Interface allows an authenticated administrator to submit local DNS record values that contain double quotes, causing the data\u2011tag attribute to close prematurely. This unsanitized input is stored in the configuration and rendered each time the records table is displayed, enabling stored HTML injection. Because Pi\u2011hole implements a Content Security Policy that forbids inline JavaScript, the risk of script execution is reduced, yet the vulnerability still permits malicious HTML elements to appear on the page.", "risk_and_exploitability": "The vulnerability has a CVSS score of\u202f5.4, indicating moderate severity, and an EPSS score of less than\u202f1\u202f%, suggesting a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation demands that an attacker first obtain authenticated administrator access to the Pi\u2011hole interface, after which the injected HTML is rendered during normal browsing of the DNS records table."}}}}, "created": "2026-02-20T09:53:39.123377+00:00", "updated": "2026-04-18T11:45:44.598657+00:00", "vendors": ["pi-hole", "pi-hole$PRODUCT$web"]}