CVE-2023-41898: Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in…

PriorityP338high7.8CVSS 3.1

AVLACLPRNUIRSUCHIHAH

EPSS

0.16%

6.0th percentile

Home assistant is an open source home automation. The Home Assistant Companion for Android app up to version 2023.8.2 is vulnerable to arbitrary URL loading in a WebView. This enables all sorts of attacks, including arbitrary JavaScript execution, limited native code execution, and credential theft. This issue has been patched in version 2023.9.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GitHub Security Lab (GHSL) Vulnerability Report: `GHSL-2023-142`.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
home-assistant	core	< 2023.9.2	2023.9.2
home-assistant	home_assistant_companion	< 2023.9.2	2023.9.2

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.