Lack of XFO header allows clickjacking in Home Assistant Core

CVE-2023-41897

What is CVE-2023-41897?

Home Assistant, an open-source home automation platform, has a security vulnerability due to the lack of essential HTTP security headers, including the X-Frame-Options header. This omission may enable clickjacking attacks, allowing malicious actors to deceive users into interacting with external content, potentially leading to the installation of harmful add-ons without user consent. This could trigger Remote Code Execution (RCE) within the application. It is crucial for users to upgrade to version 2023.9.0 or later to mitigate this risk, as no workarounds are currently available.

References