home-assistant Vulnerabilities and Affected Products
Vulnerabilities associated with Home Assistant Community Store (HACS).
Products
Clear product- core21 vulnerabilities
- Home Assistant Core3 vulnerabilities
- Home Assistant Community Store (HACS)1 vulnerability
- Home Assistant Operating System1 vulnerability
- Home Assistant Supervisor1 vulnerability
- home-assistant1 vulnerability
- supervisor1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2021-47942HIGH | Home Assistant Community Store 1.10.0 Path Traversal Account TakeoverHome Assistant Community Store (HACS) prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh tokens, then craft valid JWT tokens to gain administrative access to Home Assistant instances. CWE-22May 16, 2026 | CVSS8.7v4.0 | EPSS0.498% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |