Home Assistant information disclosure vulnerability

HIGH 7.5CVE-2018-21019 · GHSA-mh78-8f49-vjg3 · PYSEC-2019-221 · Published 23/09/2019 · updated 17/06/2026

In short

CVE-2018-21019 is a HIGH (CVSS 7.5) vulnerability affecting homeassistant, home-assistant (home-assistant).
Chance of exploitation in the next 30 days (EPSS): 1.7%, higher than 77.1% of all vulnerabilities.
Fix: update to 0.67.0 or later.

Package	Affected versions	Patched versions
homeassistant PyPI	`< 0.67.0`	`0.67.0`
home-assistant home-assistant	`< 0.67.0`	`0.67.0`

Description

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

NVD description

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

References

nvd.nist.gov/vuln/detail/CVE-2018-21019 · ADVISORY
home-assistant/core#13836 · WEB
home-assistant/home-assistant#13836 · WEB
home-assistant/core commit 598f093 · WEB
home-assistant/core · PACKAGE
home-assistant/core release 0.67.0 · WEB
home-assistant/home-assistant release 0.67.0 · WEB
pypa/advisory-database · WEB
GitHub Advisory GHSA-mh78-8f49-vjg3 · ADVISORY

More vulnerabilities in homeassistant

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

homeassistant

PyPI

< 0.67.0

0.67.0

home-assistant

< 0.67.0

0.67.0

Description

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

NVD description

Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.

More vulnerabilities in homeassistant

See all →