CVE-2026-64823 is a cross-site scripting vulnerability in Home Assistant Core prior to version 2026.5.4, specifically in the Shelly integration's async_get_media_image() method. The vulnerability arises because the method does not properly validate the content type of data URIs supplied via the Shelly device's thumb field, allowing an attacker to serve arbitrary HTML content with a text/html content type instead of restricting to image types. This leads to the media player proxy endpoint serving attacker-controlled bytes in the Home Assistant web origin, enabling session token theft from local storage and unauthorized authenticated actions on sensitive service endpoints such as locks, alarms, and covers.

An attacker controlling a Shelly device's thumb field can exploit this vulnerability to inject arbitrary HTML content into the Home Assistant web interface. This can lead to theft of session tokens stored locally and allow the attacker to perform authenticated calls to sensitive service endpoints, potentially compromising device controls like locks, alarms, and covers. The CVSS 4.0 score is low (2.1) with network attack vector, high attack complexity, no privileges required, and user interaction needed. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability affects versions prior to 2026.5.4. Users should upgrade to version 2026.5.4 or later once available. Until a patch is applied, restrict access to Shelly devices and the Home Assistant interface to trusted users only to reduce risk.