homeassistant-stubs (2022.11.0b6), pytest-homeassistant-custom-component (0.12.16) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b6)

homeassistant PYPI version 2022.11.0b6 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b6 - pytest-homeassistant-custom-component 0.12.16 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.11.0b1), pytest-homeassistant-custom-component (0.12.12) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b1)

homeassistant PYPI version 2022.11.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b1 - pytest-homeassistant-custom-component 0.12.12 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.10.0b5), pytest-homeassistant-custom-component (0.12.3) potentially affected by CVE-2026-91129 via homeassistant (2022.10.0b5)

homeassistant PYPI version 2022.10.0b5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.0b5 - pytest-homeassistant-custom-component 0.12.3 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.10.0b2), pytest-homeassistant-custom-component (0.12.0) potentially affected by CVE-2026-91129 via homeassistant (2022.10.0b2)

homeassistant PYPI version 2022.10.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.0b2 - pytest-homeassistant-custom-component 0.12.0 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.9.3), pytest-homeassistant-custom-component (0.11.22) potentially affected by CVE-2026-91129 via homeassistant (2022.9.3)

homeassistant PYPI version 2022.9.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.3 - pytest-homeassistant-custom-component 0.11.22 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.11.0b5), pytest-homeassistant-custom-component (0.12.15) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b5)

homeassistant PYPI version 2022.11.0b5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b5 - pytest-homeassistant-custom-component 0.12.15 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.11.0b3), pytest-homeassistant-custom-component (0.12.14) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b3)

homeassistant PYPI version 2022.11.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b3 - pytest-homeassistant-custom-component 0.12.14 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.11.0b2), pytest-homeassistant-custom-component (0.12.13) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b2)

homeassistant PYPI version 2022.11.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b2 - pytest-homeassistant-custom-component 0.12.13 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.11.4), pytest-homeassistant-custom-component (0.12.21) potentially affected by CVE-2026-91129 via homeassistant (2022.11.4)

homeassistant PYPI version 2022.11.4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.4 - pytest-homeassistant-custom-component 0.12.21 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.10.1), pytest-homeassistant-custom-component (0.12.6) potentially affected by CVE-2026-91129 via homeassistant (2022.10.1)

homeassistant PYPI version 2022.10.1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.10.1 - pytest-homeassistant-custom-component 0.12.6 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.6.0b1), pytest-homeassistant-custom-component (0.9.5) potentially affected by CVE-2026-91129 via homeassistant (2022.6.0b1)

homeassistant PYPI version 2022.6.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.6.0b1 - pytest-homeassistant-custom-component 0.9.5 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2023.11.0b3), pytest-homeassistant-custom-component (0.13.72) potentially affected by CVE-2026-91129 via homeassistant (2023.11.0b3)

homeassistant PYPI version 2023.11.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.11.0b3 - pytest-homeassistant-custom-component 0.13.72 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2023.8.3), pytest-homeassistant-custom-component (0.13.52) potentially affected by CVE-2026-91129 via homeassistant (2023.8.3)

homeassistant PYPI version 2023.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.8.3 - pytest-homeassistant-custom-component 0.13.52 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.6.0b4), pytest-homeassistant-custom-component (0.9.8) potentially affected by CVE-2026-91129 via homeassistant (2022.6.0b4)

homeassistant PYPI version 2022.6.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.6.0b4 - pytest-homeassistant-custom-component 0.9.8 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.12.0b2), pytest-homeassistant-custom-component (0.12.24) potentially affected by CVE-2026-91129 via homeassistant (2022.12.0b2)

homeassistant PYPI version 2022.12.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.0b2 - pytest-homeassistant-custom-component 0.12.24 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.9.5), pytest-homeassistant-custom-component (0.11.24) potentially affected by CVE-2026-91129 via homeassistant (2022.9.5)

homeassistant PYPI version 2022.9.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.5 - pytest-homeassistant-custom-component 0.11.24 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.4.0b1), pytest-homeassistant-custom-component (0.8.1) potentially affected by CVE-2026-91129 via homeassistant (2022.4.0b1)

homeassistant PYPI version 2022.4.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.4.0b1 - pytest-homeassistant-custom-component 0.8.1 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.12.0b1), pytest-homeassistant-custom-component (0.12.23) potentially affected by CVE-2026-91129 via homeassistant (2022.12.0b1)

homeassistant PYPI version 2022.12.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.0b1 - pytest-homeassistant-custom-component 0.12.23 Source cves: CVE-2026-91129 Source advisory:...

PYSEC-2026-4037 djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

Impact Many djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...

djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags

ImpactMany djust built-in component template tags djust.components.templatetags. render a developer/user-supplied URL into an href / action attribute, HTML-escaping it with conditionalescape but never validating the URL scheme. HTML escaping prevents attribute breakout but does not neutralize a...