CVE-2026-26953

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26953", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-16T22:20:28.611Z", "datePublished": "2026-02-19T22:50:08.429Z", "dateUpdated": "2026-02-20T15:39:52.782Z"}, "containers": {"cna": {"title": "Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-116", "lang": "en", "description": "CWE-116: Improper Encoding or Escaping of Output", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6"}, {"name": "https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d", "tags": ["x_refsource_MISC"], "url": "https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d"}, {"name": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/pi-hole/web/releases/tag/v6.4.1"}], "affected": [{"vendor": "pi-hole", "product": "web", "versions": [{"version": "< 6.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T22:50:08.429Z"}, "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery\u2019s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1."}], "source": {"advisory": "GHSA-8rw8-vjgp-rwj6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:27:18.921340Z", "id": "CVE-2026-26953", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:39:52.782Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26953", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-20T15:27:18.921340Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:27:20.608Z"}}], "cna": {"title": "Pi-hole Web Interface has Stored HTML Injection via X-Forwarded-For Header in Active Sessions Table", "source": {"advisory": "GHSA-8rw8-vjgp-rwj6", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "pi-hole", "product": "web", "versions": [{"status": "affected", "version": "< 6.4.1"}]}], "references": [{"url": "https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6", "name": "https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d", "name": "https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "name": "https://github.com/pi-hole/web/releases/tag/v6.4.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery\u2019s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-116", "description": "CWE-116: Improper Encoding or Escaping of Output"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T22:50:08.429Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26953", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:39:52.782Z", "dateReserved": "2026-02-16T22:20:28.611Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T22:50:08.429Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "web", "vendor": "pi-hole", "versions": [{"status": "affected", "version": "< 6.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A4691B2-6ECB-42D3-9E31-3D2CCE17A62D", "versionEndExcluding": "6.4.1", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. Versions 6.0 and above have a Stored HTML Injection vulnerability in the active sessions table located on the API settings page, allowing an attacker with valid credentials to inject arbitrary HTML code that will be rendered in the browser of any administrator who visits the active sessions page. The rowCallback function contains the value data.x_forwarded_for, which is directly concatenated into an HTML string and inserted into the DOM using jQuery\u2019s .html() method. This method interprets the content as HTML, which means that any HTML tags present in the value will be parsed and rendered by the browser. An attacker can use common tools such as curl, wget, Python requests, Burp Suite, or even JavaScript fetch() to send an authentication request with an X-Forwarded-For header that contains malicious HTML code instead of a legitimate IP address. Since Pi-hole implements a Content Security Policy (CSP) that blocks inline JavaScript, the impact is limited to pure HTML injection without the ability to execute scripts. This issue has been fixed in version 6.4.1."}, {"lang": "es", "value": "La Interfaz de administraci\u00f3n de Pi-hole es una interfaz web para gestionar Pi-hole, una aplicaci\u00f3n de bloqueo de anuncios y rastreadores de internet a nivel de red. Las versiones 6.0 y superiores tienen una vulnerabilidad de inyecci\u00f3n HTML almacenada en la tabla de sesiones activas ubicada en la p\u00e1gina de configuraci\u00f3n de la API, permitiendo a un atacante con credenciales v\u00e1lidas inyectar c\u00f3digo HTML arbitrario que se renderizar\u00e1 en el navegador de cualquier administrador que visite la p\u00e1gina de sesiones activas. La funci\u00f3n rowCallback contiene el valor data.x_forwarded_for, que se concatena directamente en una cadena HTML y se inserta en el DOM utilizando el m\u00e9todo .html() de jQuery. Este m\u00e9todo interpreta el contenido como HTML, lo que significa que cualquier etiqueta HTML presente en el valor ser\u00e1 analizada y renderizada por el navegador. Un atacante puede usar herramientas comunes como curl, wget, Python requests, Burp Suite, o incluso JavaScript fetch() para enviar una solicitud de autenticaci\u00f3n con una cabecera X-Forwarded-For que contiene c\u00f3digo HTML malicioso en lugar de una direcci\u00f3n IP leg\u00edtima. Dado que Pi-hole implementa una Pol\u00edtica de Seguridad de Contenido (CSP) que bloquea JavaScript en l\u00ednea, el impacto se limita a la inyecci\u00f3n de HTML puro sin la capacidad de ejecutar scripts. Este problema ha sido solucionado en la versi\u00f3n 6.4.1."}], "id": "CVE-2026-26953", "lastModified": "2026-06-17T10:26:26.537", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26953", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:27:18.921340Z", "version": "2.0.3"}}]}, "published": "2026-02-19T23:16:26.413", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/pi-hole/web/commit/1a0c6f4fe6d0116fd2846b2adaae95996b7f194d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/pi-hole/web/releases/tag/v6.4.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/pi-hole/web/security/advisories/GHSA-8rw8-vjgp-rwj6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-79"}, {"lang": "en", "value": "CWE-116"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,6.4.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "web", "source": "cna", "vendor": "pi-hole"}, "product": "web", "vendor": "pi-hole"}], "analysis": {"en": {"generated_at": "2026-04-17T17:48:04.944925+00:00", "value": {"mitigation_remediation": ["Upgrade Pi\u2011hole to version\u202f6.4.1 (or later) to apply the fixed code. ", "Restrict access to the web interface so that only trusted administrators can log in, reducing the exposure surface for authenticated injection. ", "Enable or enforce a strict Content\u2011Security\u2011Policy on the server or reverse\u2011proxy so that even if HTML content were injected, script execution would remain blocked."], "summary": {"action": "Apply Patch", "impact": "Stored HTML Injection via X-Forwarded-For header"}, "threat_synthesis": {"affected_systems": "Pi\u2011hole admin interface versions ranging from 6.0 up to, but not including, 6.4.1 are vulnerable. The issue has been fixed in version 6.4.1, which is available on the Pi\u2011hole GitHub releases page.", "description_and_impact": "Pi\u2011hole\u2019s web interface has a stored HTML injection flaw in the active sessions table on the API settings page. The application concatenates the value of the X\u2011Forwarded\u2011For header into an HTML string that is rendered with jQuery\u2019s .html() method. Because the site implements a Content Security Policy that blocks inline JavaScript, an attacker cannot run scripts, but any injected HTML will be rendered in the browser of an administrator who views the active sessions page. This allows a malicious actor to display arbitrary markup, potentially phishing or misleading users, but does not directly provide code execution or data exfiltration.", "risk_and_exploitability": "The vulnerability has a CVSS score of 5.4, indicating moderate severity, and an EPSS score of less than 1\u202f%, suggesting a low but non\u2011zero probability of exploitation. The attacker must be authenticated and possess valid login credentials to inject malicious HTML via the X\u2011Forwarded\u2011For header. Because the site enforces a CSP that blocks inline scripts, the potential impact is limited to pure markup injection; however, an attacker could still trick administrators into clicking misleading links or interacting with spoofed UI elements."}}}}, "created": "2026-02-20T09:53:36.493697+00:00", "updated": "2026-04-17T18:00:12.162855+00:00", "vendors": ["pi-hole", "pi-hole$PRODUCT$web"]}