What is CVE-2023-41898?

CVE-2023-41898 is a high-severity vulnerability in Home-Assistant Core, classified under Code Injection. CVSS score: 8.6/10. Published 2023-10-19.

How severe is CVE-2023-41898?

High severity. CVSS v3 base score is 8.6 out of 10.

Is CVE-2023-41898 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Home-Assistant Core

CVE-2023-41898

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.002 (6.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.

Affected products

Home-assistant Core — versions < 2023.9.2
Home-assistant Home_assistant_companion

Weakness classification (CWE)

Public proof-of-concept exploits

LazyBear8372/CVE-2023-41898_Lab

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2023-41898?: CVE-2023-41898 is a high-severity vulnerability in Home-Assistant Core, classified under Code Injection. CVSS score: 8.6/10. Published 2023-10-19.
How severe is CVE-2023-41898?: High severity. CVSS v3 base score is 8.6 out of 10.
Is CVE-2023-41898 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.