Vulnerability · Published Apr 6, 2026 · Assigned by GitHub_M

CVE-2026-33405Pi-hole has a Stored HTML Injection in queries.js

Low 3.1

In plain English

A low-severity cross-site scripting in web from pi-hole. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo() function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a query row in the Query Log, enabling stored HTML injection. JavaScript execution is blocked by the server's CSP (script-src 'self'). The same fields are properly escaped in the table view (rowCallback), confirming the omission was an oversight. This vulnerability is fixed in 6.5.

Affected products (as reported)

Vendor	Product	Versions
pi-hole	web	>= 6.0, < 6.5

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/pi-hole/web/security/advisories/GHSA-jx8x-mj2r-62vq x_refsource_CONFIRM