Threats affecting pkg:github/Tasmota

CVE-2026-119756 is a critical heap out-of-bounds write vulnerability in Tasmota firmware up to version 16.0.0. It occurs in the SendReceiveDeviceGroupMessage() function when processing crafted Device Groups messages over UDP port 4447. This flaw allows unauthenticated attackers on the local network to corrupt heap memory, potentially causing device crashes or native code execution on ESP8266 and ESP32 devices lacking ASLR and heap cookies. The vulnerability is fixed in a commit identified as e97e1e4.

Tasmota versions up to 16.0.0 have a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protections by crafting malicious Referer headers. This can enable attackers to execute arbitrary console commands and reconfigure device settings if no WebPassword is set. The issue was fixed in commit 1cb7ebc.