The vulnerability allows an attacker to inject arbitrary HTML and JavaScript into the Pi‑hole Admin Interface. Data such as client hostnames and IP addresses are rendered into the DOM without escaping, creating a stored cross‑site scripting weakness of type CWE‑79. Successful exploitation could lead to session hijacking or malicious code execution within the victim’s browser, potentially compromising sensitive network information.

This flaw affects the Pi‑hole web interface in versions 6.0 through 6.4. The issue was fixed in release 6.5. Users running any of these versions should verify their installation. The vulnerable components are network.js on the Network page and charts.js/index.js used for dashboard tooltips.

The CVSS score of 3.4 indicates low severity, and the EPSS probability is below 1 %, suggesting that exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is access to the web UI, which is typically limited to local network users or administrators. An attacker would need to deliver malicious input that the application stores and later serves to a logged‑in user, which may require privileged or authenticated access to the admin interface.