CVE-2026-33404

Name of the Vulnerable Software and Affected Versions Pi-hole Admin Interface versions 6.0 through 6.4

Description Client hostnames and IP addresses from the FTL database are rendered into the Document Object Model (DOM) without proper escaping in the Network page (network.js) and Dashboard chart tooltips (charts.js/index.js). Although upstream validation in dnsmasq and FTL blocks HTML characters through standard DHCP and DNS paths, the web interface fails to perform output escaping, creating an inconsistency with other properly escaped fields in the same files.

Recommendations Update to version 6.5.