(Pwn2Own) Home Assistant Green go2rtc Command Injection Remote Code Execution Vulnerability

August 12th, 2026
ZDI-26-561 ZDI-CAN-28429

CVE ID

CVSS Score

7.5 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors

Home Assistant

Affected Products

Green

Vulnerability Details

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Home Assistant Green. An attacker must first obtain the ability to access the device's localhost interface.

The specific flaw exists within the go2rtc process. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root.

Additional Details

Fixed in go2rtc v1.9.14 and Home Assistant
https://github.com/AlexxIT/go2rtc#security


Disclosure Timeline

  • 2025-11-05 - Vulnerability reported to vendor
  • 2026-08-12 - Coordinated public release of advisory
  • 2026-08-12 - Advisory Updated

Credit

Stephen Fewer (Rapid7)

Back to Advisories