A reflected DOM‑based cross‑site scripting flaw exists in the taillog.js file of the Pi‑hole admin interface. The script retrieves a query parameter and assigns it directly to an innerHTML property without any escaping or sanitisation. This allows an attacker to inject arbitrary HTML and JavaScript into the page. Because the Content‑Security‑Policy header is missing a form‑action directive, malicious <form> elements can be inserted and used to exfiltrate credentials to an external domain.

The vulnerability affects the Pi‑hole web interface in all releases from version 6.0 up to, but not including, 6.5. Any installation of Pi‑hole using those versions and exposing the admin interface to untrusted networks is exposed.

The CVSS score of 6.1 indicates moderate severity. The EPSS score of less than 1% suggests a low likelihood of mass exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. An unauthenticated attacker can exploit the flaw simply by crafting a malicious URL and luring a legitimate user to the Pi‑hole admin interface, making it a straightforward local or network attack vector.