Description

Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.4",
  "pubDate": "2026-08-07T21:17:27.010Z",
  "pubdate": "2026-08-07T21:17:27.010Z",
  "executiveSummary": "Domoticz versions prior to 2026.3 contain a stored cross-site scripting (XSS) vulnerability located within the mobile dashboard component.\nThe vulnerability allows authenticated attackers to inject arbitrary HTML and JavaScript payloads by updating Text or Alert subtype device values through the application API.\nWhen an administrator views the mobile dashboard, the stored malicious payload is rendered and executed within their browser context.\nThe primary impact includes session cookie theft and potential full account takeover.\nExploitation requires authentication and the ability to update specific device values via the API.",
  "technicalDetails": "The root cause of the vulnerability resides in the insecure rendering mechanism of the mobile dashboard, which utilizes ng-bind-html combined solely with an nl2br() transform.\nThis processing pipeline performs no adequate HTML escaping on the device data before rendering it in the DOM.\nThe vulnerable components are the mobile dashboard interface and the API endpoints responsible for handling Text or Alert subtype device value updates.\nAffected products include Domoticz versions prior to 2026.3.\nAttackers must be authenticated to interact with the API and update the target device values.\nThe attack flow proceeds as follows: First, an authenticated attacker sends a crafted API request to update the value of a Text or Alert subtype device with malicious HTML and JavaScript payloads. Second, the Domoticz backend stores these malicious values in the database without sanitization. Third, an administrator navigates to the mobile dashboard. Fourth, the Angular frontend processes the stored device data using ng-bind-html and nl2br() without proper HTML escaping. Fifth, the injected JavaScript executes within the administrator's browser session.\nPayload behavior includes DOM manipulation, execution of arbitrary script logic, and unauthorized access to sensitive browser storage or session cookies.\nPost-exploitation impact enables attackers to hijack administrator sessions, leading to complete account takeover and potentially full administrative control over the underlying Domoticz instance."
}