{"affected":[{"product":"device-builder","source":"CNA: GitHub_M","vendor":"esphome","versions":[{"status":"affected","version":"< 1.0.10"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"esphome-device-builder","product":"esphome-device-builder","source":"OSV GHSA-vv4j-m4vr-f3g6","vendor":"","versions":[{"status":"affected","version":"0.1.0b10","versionType":"PyPI"},{"status":"affected","version":"0.1.0b100","versionType":"PyPI"},{"status":"affected","version":"0.1.0b101","versionType":"PyPI"},{"status":"affected","version":"0.1.0b102","versionType":"PyPI"},{"status":"affected","version":"0.1.0b103","versionType":"PyPI"},{"status":"affected","version":"0.1.0b104","versionType":"PyPI"},{"status":"affected","version":"0.1.0b105","versionType":"PyPI"},{"status":"affected","version":"0.1.0b106","versionType":"PyPI"},{"status":"affected","version":"0.1.0b107","versionType":"PyPI"},{"status":"affected","version":"0.1.0b108","versionType":"PyPI"},{"status":"affected","version":"0.1.0b109","versionType":"PyPI"},{"status":"affected","version":"0.1.0b11","versionType":"PyPI"},{"status":"affected","version":"0.1.0b110","versionType":"PyPI"},{"status":"affected","version":"0.1.0b111","versionType":"PyPI"},{"status":"affected","version":"0.1.0b112","versionType":"PyPI"},{"status":"affected","version":"0.1.0b113","versionType":"PyPI"},{"status":"affected","version":"0.1.0b114","versionType":"PyPI"},{"status":"affected","version":"0.1.0b115","versionType":"PyPI"},{"status":"affected","version":"0.1.0b116","versionType":"PyPI"},{"status":"affected","version":"0.1.0b117","versionType":"PyPI"},{"status":"affected","version":"0.1.0b118","versionType":"PyPI"},{"status":"affected","version":"0.1.0b119","versionType":"PyPI"},{"status":"affected","version":"0.1.0b12","versionType":"PyPI"},{"status":"affected","version":"0.1.0b13","versionType":"PyPI"},{"status":"affected","version":"0.1.0b14","versionType":"PyPI"},{"status":"affected","version":"0.1.0b15","versionType":"PyPI"},{"status":"affected","version":"0.1.0b16","versionType":"PyPI"},{"status":"affected","version":"0.1.0b17","versionType":"PyPI"},{"status":"affected","version":"0.1.0b18","versionType":"PyPI"},{"status":"affected","version":"0.1.0b19","versionType":"PyPI"},{"status":"affected","version":"0.1.0b20","versionType":"PyPI"},{"status":"affected","version":"0.1.0b21","versionType":"PyPI"},{"status":"affected","version":"0.1.0b22","versionType":"PyPI"},{"status":"affected","version":"0.1.0b23","versionType":"PyPI"},{"status":"affected","version":"0.1.0b24","versionType":"PyPI"},{"status":"affected","version":"0.1.0b25","versionType":"PyPI"},{"status":"affected","version":"0.1.0b26","versionType":"PyPI"},{"status":"affected","version":"0.1.0b27","versionType":"PyPI"},{"status":"affected","version":"0.1.0b28","versionType":"PyPI"},{"status":"affected","version":"0.1.0b29","versionType":"PyPI"},{"status":"affected","version":"0.1.0b30","versionType":"PyPI"},{"status":"affected","version":"0.1.0b31","versionType":"PyPI"},{"status":"affected","version":"0.1.0b32","versionType":"PyPI"},{"status":"affected","version":"0.1.0b33","versionType":"PyPI"},{"status":"affected","version":"0.1.0b34","versionType":"PyPI"},{"status":"affected","version":"0.1.0b35","versionType":"PyPI"},{"status":"affected","version":"0.1.0b36","versionType":"PyPI"},{"status":"affected","version":"0.1.0b37","versionType":"PyPI"},{"status":"affected","version":"0.1.0b38","versionType":"PyPI"},{"status":"affected","version":"0.1.0b39","versionType":"PyPI"},{"status":"affected","version":"0.1.0b40","versionType":"PyPI"},{"status":"affected","version":"0.1.0b41","versionType":"PyPI"},{"status":"affected","version":"0.1.0b42","versionType":"PyPI"},{"status":"affected","version":"0.1.0b43","versionType":"PyPI"},{"status":"affected","version":"0.1.0b44","versionType":"PyPI"},{"status":"affected","version":"0.1.0b45","versionType":"PyPI"},{"status":"affected","version":"0.1.0b46","versionType":"PyPI"},{"status":"affected","version":"0.1.0b47","versionType":"PyPI"},{"status":"affected","version":"0.1.0b48","versionType":"PyPI"},{"status":"affected","version":"0.1.0b49","versionType":"PyPI"},{"status":"affected","version":"0.1.0b50","versionType":"PyPI"},{"status":"affected","version":"0.1.0b51","versionType":"PyPI"},{"status":"affected","version":"0.1.0b52","versionType":"PyPI"},{"status":"affected","version":"0.1.0b53","versionType":"PyPI"},{"status":"affected","version":"0.1.0b54","versionType":"PyPI"},{"status":"affected","version":"0.1.0b55","versionType":"PyPI"},{"status":"affected","version":"0.1.0b56","versionType":"PyPI"},{"status":"affected","version":"0.1.0b57","versionType":"PyPI"},{"status":"affected","version":"0.1.0b58","versionType":"PyPI"},{"status":"affected","version":"0.1.0b59","versionType":"PyPI"},{"status":"affected","version":"0.1.0b60","versionType":"PyPI"},{"status":"affected","version":"0.1.0b61","versionType":"PyPI"},{"status":"affected","version":"0.1.0b62","versionType":"PyPI"},{"status":"affected","version":"0.1.0b63","versionType":"PyPI"},{"status":"affected","version":"0.1.0b64","versionType":"PyPI"},{"status":"affected","version":"0.1.0b65","versionType":"PyPI"},{"status":"affected","version":"0.1.0b66","versionType":"PyPI"},{"status":"affected","version":"0.1.0b67","versionType":"PyPI"},{"status":"affected","version":"0.1.0b68","versionType":"PyPI"},{"status":"affected","version":"0.1.0b69","versionType":"PyPI"},{"status":"affected","version":"0.1.0b70","versionType":"PyPI"},{"status":"affected","version":"0.1.0b71","versionType":"PyPI"},{"status":"affected","version":"0.1.0b72","versionType":"PyPI"},{"status":"affected","version":"0.1.0b73","versionType":"PyPI"},{"status":"affected","version":"0.1.0b74","versionType":"PyPI"},{"status":"affected","version":"0.1.0b75","versionType":"PyPI"},{"status":"affected","version":"0.1.0b76","versionType":"PyPI"},{"status":"affected","version":"0.1.0b77","versionType":"PyPI"},{"status":"affected","version":"0.1.0b78","versionType":"PyPI"},{"status":"affected","version":"0.1.0b79","versionType":"PyPI"},{"status":"affected","version":"0.1.0b80","versionType":"PyPI"},{"status":"affected","version":"0.1.0b81","versionType":"PyPI"},{"status":"affected","version":"0.1.0b82","versionType":"PyPI"},{"status":"affected","version":"0.1.0b83","versionType":"PyPI"},{"status":"affected","version":"0.1.0b84","versionType":"PyPI"},{"status":"affected","version":"0.1.0b85","versionType":"PyPI"},{"status":"affected","version":"0.1.0b86","versionType":"PyPI"},{"status":"affected","version":"0.1.0b87","versionType":"PyPI"},{"status":"affected","version":"0.1.0b88","versionType":"PyPI"},{"status":"affected","version":"0.1.0b89","versionType":"PyPI"},{"status":"affected","version":"0.1.0b90","versionType":"PyPI"},{"status":"affected","version":"0.1.0b91","versionType":"PyPI"},{"status":"affected","version":"0.1.0b92","versionType":"PyPI"},{"status":"affected","version":"0.1.0b93","versionType":"PyPI"},{"status":"affected","version":"0.1.0b94","versionType":"PyPI"},{"status":"affected","version":"0.1.0b95","versionType":"PyPI"},{"status":"affected","version":"0.1.0b96","versionType":"PyPI"},{"status":"affected","version":"0.1.0b97","versionType":"PyPI"},{"status":"affected","version":"0.1.0b98","versionType":"PyPI"},{"status":"affected","version":"0.1.0b99","versionType":"PyPI"},{"status":"affected","version":"1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.0.1","versionType":"PyPI"},{"status":"affected","version":"1.0.10b1","versionType":"PyPI"},{"status":"affected","version":"1.0.10b2","versionType":"PyPI"},{"status":"affected","version":"1.0.2b1","versionType":"PyPI"},{"status":"affected","version":"1.0.2b2","versionType":"PyPI"},{"status":"affected","version":"1.0.2b3","versionType":"PyPI"},{"status":"affected","version":"1.0.2b4","versionType":"PyPI"},{"status":"affected","version":"1.0.3","versionType":"PyPI"},{"status":"affected","version":"1.0.4","versionType":"PyPI"},{"status":"affected","version":"1.0.5","versionType":"PyPI"},{"status":"affected","version":"1.0.6","versionType":"PyPI"},{"status":"affected","version":"1.0.7","versionType":"PyPI"},{"status":"affected","version":"1.0.8","versionType":"PyPI"},{"status":"affected","version":"1.0.9","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"1.0.10"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-59177","cwes":["CWE-1327"],"description":"ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the `Home Assistant` host's LAN interface. Any device on that local network can therefore connect directly to the `ingress` port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through `external_components:`, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted `Home Assistant` configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.","epss":{"date":"2026-11-02","percentile":0.67373,"score":0.01168},"exploits":[],"kev":null,"metrics":[{"score":8.8,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793650552405,"publishedAt":1793193134620,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/esphome/device-builder/security/advisories/GHSA-vv4j-m4vr-f3g6"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/esphome/device-builder/pull/1565"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/esphome/device-builder/commit/b6387db3f8bf1d3df5771f40e9856b959ae4f6a1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/esphome/device-builder/releases/tag/1.0.10"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-vv4j-m4vr-f3g6"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6"}],"remediation":[{"kind":"fix","source":"OSV GHSA-vv4j-m4vr-f3g6","text":"esphome-device-builder (PyPI): OSV reports a fixed version 1.0.10. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-vv4j-m4vr-f3g6"}],"revision":"21c303e14208aee6d0c42d8360a219f48a5cfa1f654126241c168f819b0421fc","sources":[{"modifiedAt":1793650552405,"name":"CNA: GitHub_M","retrievedAt":1793653864545,"url":"https://www.cve.org/CVERecord?id=CVE-2026-59177"},{"modifiedAt":1789043167204,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653866271,"url":"https://osv.dev/vulnerability/GHSA-vv4j-m4vr-f3g6"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653891499,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59177"}],"ssvc":{"assessedAt":1793650541964,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces","updatedAt":1793653891499}