diff --git a/advisories/github-reviewed/2024/03/GHSA-5925-88xh-6h99/GHSA-5925-88xh-6h99.json b/advisories/github-reviewed/2024/03/GHSA-5925-88xh-6h99/GHSA-5925-88xh-6h99.json
new file mode 100644
index 00000000000..af072a12b61
--- /dev/null
+++ b/advisories/github-reviewed/2024/03/GHSA-5925-88xh-6h99/GHSA-5925-88xh-6h99.json
@@ -0,0 +1,61 @@
+{
+ "schema_version": "1.4.0",
+ "id": "GHSA-5925-88xh-6h99",
+ "modified": "2024-03-21T16:26:35Z",
+ "published": "2024-03-21T16:26:35Z",
+ "aliases": [
+ "CVE-2024-29019"
+ ],
+ "summary": "Authentication bypass via Cross site request forgery",
+ "details": "### Summary\nAPI endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete).\n\n### Details\nIt is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform.\n\n### PoC\nAn example of malicious web page that abuses this vulnerability:\n\n\n\n \n\t\n\n\t\n\n\t\n \n\n\nIn which an attacker creates and weaponizes \"poc.yaml\" config file containing a cookie exfiltration script and forces the payload triggering visiting the vulnerable page.\n\n\nExample of such script:\n\n\n\n### Impact\nThis vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page.\n\nIn addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5 (as seen in the PoC) to obtain a complete takeover of the user account.\n\n",
+ "severity": [
+ {
+ "type": "CVSS_V3",
+ "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
+ }
+ ],
+ "affected": [
+ {
+ "package": {
+ "ecosystem": "PyPI",
+ "name": "esphome"
+ },
+ "ranges": [
+ {
+ "type": "ECOSYSTEM",
+ "events": [
+ {
+ "introduced": "2023.12.9"
+ },
+ {
+ "fixed": "2024.3.0"
+ }
+ ]
+ }
+ ]
+ }
+ ],
+ "references": [
+ {
+ "type": "WEB",
+ "url": "https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99"
+ },
+ {
+ "type": "ADVISORY",
+ "url": "https://github.com/advisories/GHSA-9p43-hj5j-96h5"
+ },
+ {
+ "type": "PACKAGE",
+ "url": "https://github.com/esphome/esphome"
+ }
+ ],
+ "database_specific": {
+ "cwe_ids": [
+ "CWE-352"
+ ],
+ "severity": "HIGH",
+ "github_reviewed": true,
+ "github_reviewed_at": "2024-03-21T16:26:35Z",
+ "nvd_published_at": null
+ }
+}
\ No newline at end of file