cyfenced.com →

[ CVE-2026-91130 · Published 22 Sep 2026 ]

Home Assistant: XSS in Statistics Graph Card

CVSS 9.3 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 9.3

[ Description ]Official description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

[ Fixes ]Fixes and patches

  • homeassistant 2026.7.0Fixed version · GitHub Advisories · pip package homeassistant: upgrade to 2026.7.0 or later (affected < 2026.7.0)

[ Packages ]Affected open-source packages

[ References ]References