Pi‑hole’s web interface has a stored HTML injection flaw in the active sessions table on the API settings page. The application concatenates the value of the X‑Forwarded‑For header into an HTML string that is rendered with jQuery’s .html() method. Because the site implements a Content Security Policy that blocks inline JavaScript, an attacker cannot run scripts, but any injected HTML will be rendered in the browser of an administrator who views the active sessions page. This allows a malicious actor to display arbitrary markup, potentially phishing or misleading users, but does not directly provide code execution or data exfiltration.

Pi‑hole admin interface versions ranging from 6.0 up to, but not including, 6.4.1 are vulnerable. The issue has been fixed in version 6.4.1, which is available on the Pi‑hole GitHub releases page.

The vulnerability has a CVSS score of 5.4, indicating moderate severity, and an EPSS score of less than 1 %, suggesting a low but non‑zero probability of exploitation. The attacker must be authenticated and possess valid login credentials to inject malicious HTML via the X‑Forwarded‑For header. Because the site enforces a CSP that blocks inline scripts, the potential impact is limited to pure markup injection; however, an attacker could still trick administrators into clicking misleading links or interacting with spoofed UI elements.