AIKIDO-2026-359630
esphome is vulnerable to Cross-Site Scripting (XSS)
88
High Risk
This Affects:
esphomeTL;DR
The ESPHome captive portal lists nearby WiFi networks and writes each scanned SSID into the served portal page and into the /config.json response without encoding it. Because an SSID is an arbitrary byte string taken directly from over-the-air beacon frames, a network name containing HTML or JSON metacharacters is rendered as markup in the unauthenticated portal page and can break out of the JSON string. Script injected this way runs in the browser of whoever opens the portal and can drive the device's unauthenticated endpoints to capture the home WiFi credentials submitted through the provisioning form. The fix assigns the network name via textContent in the frontend and escapes it through the shared json_escape_into_buffer helper before writing it into the JSON response.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you build a device with the captive_portal component enabled, which serves the unauthenticated portal that renders untrusted nearby WiFi network names.
Background info
esphome is vulnerable to Cross-Site Scripting (XSS) in versions 0.0.1 - 2026.7.2.
How to fix this
Upgrade the esphome library to the patch version. If you cannot upgrade yet, remove captive_portal: from the configuration and rebuild to remove the vulnerable portal page and the /update endpoint it auto-loads.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant