Vulnerabilities

Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-based Cross-Site Scripting (XSS) vulnerability has been discovered in Homarr's /auth/login page. The application improperly trusts a URL parameter (callbackUrl), which is passed to redirect and router.push. An attacker can craft a malicious link that, when opened by an authenticated user, performs a client-side redirect and executes arbitrary JavaScript in the context of their browser. This could lead to credential theft, internal network pivoting, and unauthorized actions performed on behalf of the victim. This vulnerability is fixed in 1.57.0.

Homarr is an open-source dashboard. Prior to version 1.54.0, the integration.all tRPC endpoint in Homarr is exposed as a publicProcedure, allowing unauthenticated users to retrieve a complete list of configured integrations. This metadata includes sensitive information such as internal service URLs, integration names, and service types. This issue has been patched in version 1.54.0.

Homarr is an open-source dashboard. Prior to 1.52.0, a public (unauthenticated) tRPC endpoint widget.app.ping accepts an arbitrary url and performs a server-side request to that URL. This allows an unauthenticated attacker to trigger outbound HTTP requests from the Homarr server, enabling SSRF behavior and a reliable port-scanning primitive (open vs closed ports can be inferred from statusCode vs fetch failed and timing). This vulnerability is fixed in 1.52.0.

Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups of other users due to missing sanitization of inputs in ldap search query. The vulnerability could impact all instances using ldap authentication where a malicious actor had access to a user account. Version 1.45.3 has a patch for the issue.

Homarr is an open-source dashboard. Prior to version 1.43.3, stored XSS vulnerability exists, allowing the execution of arbitrary JavaScript in a user's browser, with minimal or no user interaction required, due to the rendering of a malicious uploaded SVG file. This could be abused to add an attacker's account to the "credentials-admin" group, giving them full administrative access, if a user logged in as an administrator was to view the page which renders or redirects to the SVG. This issue has been patched in version 1.43.3.

CVE-2025-54313 is a supply chain compromise (CWE-506) of the widely used npm package eslint-config-prettier, in which versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contained embedded malicious code, reportedly injected after the maintainer's npm account was hijacked via a phishing campaign. The malicious code triggers automatically: installing any of these versions executes a bundled install.js file that launches the node-gyp.dll malware on Windows systems. An attacker gains code execution with the privileges of the installing user or CI job, carrying high integrity impact per the CVSS score (ability to tamper with code, build outputs, and credentials); public write-ups describe the campaign as dropping malware via hijacked npm linter packages. Affected parties are developers, build/CI pipelines, and downstream projects that installed the compromised versions; CISA identifies the affected product as Prettier's eslint-config-prettier, with related npm packages (eslint-plugin-prettier, synckit, pkgr/core, got-fetch, napi-postinstall, homarr) listed as associated products. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-01-22, and EPSS estimates a 4.3% probability of exploitation in the next 30 days (91st percentile).

Do: Stop using the compromised versions (8.10.1, 9.1.1, 10.1.6, 10.1.7): reinstall a clean release and verify lockfiles and caches do not resolve to the malicious versions. Check any Windows developer machine or CI runner that installed them for a malicious node-gyp.dll payload and rotate credentials and tokens from those environments. Federal agencies must follow the KEV required action: apply vendor mitigations or BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.