Log in Start free

Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-91130Home Assistant: XSS in Statistics Graph Card

Critical 9.3

In plain English

A critical-severity security flaw in core from home-assistant. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)9.3Critical
Exploit odds (30 days)0.5%top 58.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
PyPIhomeassistant2026.7.0GHSA-wx4m-69m9-gx3m
PyPIhomeassistant2026.7.0PYSEC-2026-4052

Affected products (as reported)

VendorProductVersions
home-assistant core < 2026.7.0

Weakness: CWE-80 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References