CVE-2026-33405

Pi-hole Admin Interface: A stored HTML injection in the formatInfo() path of queries.js (v6.0–6.4) renders data.upstream, data.client.ip, and data.ede.text into HTML when expanding a Query Log row, with JavaScript execution blocked by CSP (script-src 'self'). The same fields are properly escaped ...

CVE-2026-33405 Pi-hole has a Stored HTML Injection in queries.js

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a...

EUVD-2026-19283

Pi-hole Admin Interface is a web interface for managing Pi-hole, a network-level ad and internet tracker blocking application. From 6.0 to before 6.5, the formatInfo function in queries.js renders data.upstream, data.client.ip, and data.ede.text into HTML without escaping when a user expands a...