Pi‑hole Admin Interface allows an authenticated administrator to submit local DNS record values that contain double quotes, causing the data‑tag attribute to close prematurely. This unsanitized input is stored in the configuration and rendered each time the records table is displayed, enabling stored HTML injection. Because Pi‑hole implements a Content Security Policy that forbids inline JavaScript, the risk of script execution is reduced, yet the vulnerability still permits malicious HTML elements to appear on the page.

All Pi‑hole Web Interface deployments running version 6.4 or earlier are vulnerable. The vulnerability requires administrative authentication and is typically limited to users on the local network that can manage Pi‑hole through its web interface.

The vulnerability has a CVSS score of 5.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low probability of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Exploitation demands that an attacker first obtain authenticated administrator access to the Pi‑hole interface, after which the injected HTML is rendered during normal browsing of the DNS records table.