CVE-2026-33406

Pi-hole Admin Interface versions 6.0 through 6.4 contain an HTML attribute injection vulnerability in the settings-advanced.js file, where unescaped configuration values from the /api/config endpoint are directly inserted into HTML value attributes, allowing attackers to break out of attribute context through double quote injection. The vulnerability is primarily exploited through importing malicious teleporter backups, which circumvent per-field server-side validation controls. While direct JavaScript execution is mitigated by the server's Content Security Policy, attackers can inject attributes to perform UI redressing and styling manipulation. The vulnerability carries a CVSS score of 6.1 (Medium) with a network-based attack vector requiring minimal complexity and user interaction, affecting confidentiality and integrity with no impact on availability. The EPSS score of 0.00037 indicates extremely low prevalence in active exploitation relative to the broader CVE population. The vulnerability is not currently tracked on the Known Exploited Vulnerabilities catalog, has no public exploit code readily available, and demonstrates minimal community attention based on available threat intelligence. Remediation is available through upgrading to version 6.5 or later.