Pi‑hole Admin Interface contains a stored HTML injection flaw. When a query log entry is expanded, the formatInfo() function inserts the upstream, client IP, and query text directly into the page without escaping, allowing an attacker to embed custom HTML markup. The injected markup cannot execute JavaScript because the server enforces a Content Security Policy that permits only scripts from the same origin, so the attack surface is limited to UI manipulation and potential phishing. This issue is identified as a CWE‑79 problem.

The vulnerability affects Pi‑hole web interface versions 6.0 through 6.4 inclusive. Versions 6.5 and later include a fix that properly escapes the rendered fields. The affected vendor and product are listed as pi‑hole:web in the CNA data.

The CVSS base score of 3.1 indicates low severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The description does not state whether authentication is required, so it is unknown if an attacker needs administrative privileges. Since the Query Log is normally accessed by administrators, the flaw could be limited to users with such access. Even with the server-enforced CSP, the vulnerability still permits arbitrary HTML insertion, which can be used for social engineering or UI spoofing, but the overall risk is considered moderate and unlikely to be widely exploited at present.