Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Home Assistant graph card can run malicious code

CVE-2026-91130 · published 19 days ago
Summary

The Statistics Graph card in Home Assistant versions before 2026.7.0 did not clean up custom names before showing them in chart tooltips. If a user with access or an integration supplies a specially crafted name, hovering over a data point could cause unwanted code to run in the browser. Update Home Assistant to version 2026.7.0 or later to fix the problem.

What to do
  • Update homeassistant to version 2026.7.0.
Affected software
Ecosystem VendorProductAffected versions
– home-assistant core < 2026.7.0
pip – homeassistant < 2026.7.0
Fix: upgrade to 2026.7.0
Original advisory text
Home Assistant: XSS in Statistics Graph Card
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-80Basic XSS
Timeline
Published22 Sep 2026
Updated11 Oct 2026
First seen22 Sep 2026
Sources
CVE-2026-91130 · NVD
CVE-2026-91130 · MITRE
GHSA-wx4m-69m9-gx3m · GHSA
CVE-2026-91130 · OSV
GHSA-wx4m-69m9-gx3m · OSV
PYSEC-2026-4052 · OSV
Track software like this
Free during beta