CVE-2026-33404

OVERVIEW CVE-2026-33404 is a stored cross-site scripting (XSS) vulnerability affecting Pi-hole Admin Interface versions 6.0 through 6.4. The vulnerability exists in the Network and Dashboard pages, where client hostnames and IP addresses retrieved from the FTL database are rendered into the DOM without proper HTML escaping. This creates a pathway for malicious input to execute arbitrary JavaScript in the context of the web interface. SEVERITY The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with a network attack vector requiring no privileges but necessitating user interaction. Attack complexity is low, making exploitation straightforward for an attacker capable of injecting data into the FTL database. The impact is limited to confidentiality and integrity compromise with no availability impact. The inconsistency with properly escaped fields elsewhere in the same files suggests this was an oversight rather than a systematic vulnerability. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and has not been added to the Hot List. The EPSS score of 0.00025 indicates this vulnerability is ranked lower than approximately 99.93 percent of all CVEs in terms of exploitation probability. The patch is available in version 6.5 and should be prioritized based on organizational exposure to Pi-hole deployments.