CVE-2026-91130: Home Assistant Cross-Site Scripting Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wx4m-69m9-gx3m",
  "modified" : "2026-09-22T20:40:55Z",
  "published" : "2026-09-22T20:40:55Z",
  "aliases" : [ "CVE-2026-91130" ],
  "summary" : "Home Assistant: XSS in Statistics Graph Card",
  "details" : "### Summary\nAn authenticated party can add a malicious name to any statistics-capable entity, allowing for\nCross-Site Scripting attacks against anyone who views a Statistics Graph card containing that\nentity, when they hover over any data point on the chart.\n\n**Payload**\n<img width=\"1529\" height=\"441\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6926ce53-75fb-455a-bd4e-0c5281e8bed8\" />\n\n**Payload triggering**\n<img width=\"835\" height=\"469\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0bb9d17a-c123-4d44-8471-35097f65ddd2\" />\n\nAn alternative, and more impactful scenario, is that the entity gets a malicious name from the\nprovider of the integration (e.g. Tibber, Shelly, or any HACS integration), and is exploited\nthat way through the default name — without requiring any direct access to the Home Assistant\ninstance. This is the same supply-chain vector as CVE-2025-62172.\n\n\n### Details\n\nThe Statistics Graph card renders entity names in ECharts tooltips as raw HTML. The offending\nline is in `src/components/chart/statistics-chart.ts`:\n\nhttps://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/components/chart/statistics-chart.ts#L236\n\nWhere **_`param.seriesName`_** is interpolated verbatim into the returned HTML string:\n\n```\nreturn `${time}${param.marker} ${param.seriesName}: ${value}`;\n```\n\nNo call to `filterXSS()` is made — unlike the Energy dashboard chart, which was patched as part\nof CVE-2025-62172:\n\n```\n// FIXED in energy-chart-options.ts:268\nreturn `${param.marker} ${filterXSS(param.seriesName!)}: ...`;\n```\n\nThe `statistics-chart` component was not updated when the Energy chart was patched, leaving the\nsame class of vulnerability in place.\n\nThe existing entity and payload used for CVE-2025-62172 is also a valid exploit for this vulnerability:\n<img width=\"962\" height=\"500\" alt=\"image\" src=\"https://github.com/user-attachments/assets/35c84dcd-64d4-47b6-8df2-6c8b63cac880\" />\n\n\nThe name value flows through the following chain:\n\n1. `name` is set from `getStatisticLabel(this.hass, statistic_id, meta)`:\n   https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/components/chart/statistics-chart.ts#L411\n\n2. `getStatisticLabel` is defined here and calls `computeStateName(entity)`:\n   https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/data/recorder.ts#L329-L339\n\n3. `computeStateName` is defined here — no HTML encoding is applied:\n   https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/common/entity/compute_state_name.ts\n\nThe only transformation applied to the name is replacing underscores with spaces\n(`computeObjectId(entityId).replace(/_/g, \" \")`), which does not prevent HTML injection.\n\n\n**NB:** Do note that only the fields `Mean, State, Sum and Change` are vulnerable. The top 3 (Min, Max, Mean) or the bottom 3 (State, Sum, Change) are selected by default though, making it vulnerable by default:\n<img width=\"105\" height=\"216\" alt=\"image\" src=\"https://github.com/user-attachments/assets/7a784c90-cca5-46da-bcb9-6942ad81da0c\" />\n\nAnother requirement is that the Chart Type is of type Line, not Bar, which is also the default:\n<img width=\"133\" height=\"91\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4f131495-9000-4a80-808b-bf4be9f7a2f6\" />\n\n\n\n---\n\n### PoC\n\n1. In **Settings → Devices & Services → Helpers**, click **+ Create Helper**. (For testing)\n\n2. Choose **Template** → **Template sensor**. Fill in the form:\n   - **Name:** `test <img src=x onerror=alert(document.domain) />`\n   - **State template:** `{{0.00000001*as_timestamp(states('sensor.date_time_iso'))}}`\n   - **Unit of measurement:** `kWh`\n   - **State class:** `Measurement`\n   - Click **Submit**.\n\n<img width=\"392\" height=\"741\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6a9b2c65-93fb-4d20-89b8-5a1f47a2bcb0\" />\n\n\n3. Open a dashboard and add a **Statistics Graph** card targeting the new sensor:\n\n\n<img width=\"694\" height=\"720\" alt=\"image\" src=\"https://github.com/user-attachments/assets/83996d12-d5ba-467a-9ca1-cbc46246ddff\" />\n\n**NB:** Set time-window to 5 minutes for ease of testing so you see data quickly\n\n\n4. Hover over any data point on the chart.\n\n\n\n\n5. The `onerror` handler fires — `alert(document.domain)` executes in the browser or HTML-injection appears depending on the payload\n\n\n** Exact helper as described here**\n<img width=\"802\" height=\"441\" alt=\"image\" src=\"https://github.com/user-attachments/assets/09284c10-bc39-410a-aff0-307e0bfd0502\" />\n\n**Own sensor**\n<img width=\"962\" height=\"500\" alt=\"image\" src=\"https://github.com/user-attachments/assets/35c84dcd-64d4-47b6-8df2-6c8b63cac880\" />\n\n**Own sensor 2**\n<img width=\"835\" height=\"469\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0bb9d17a-c123-4d44-8471-35097f65ddd2\" />\n---\n\n### Impact\n\nThe vulnerability can be exploited remotely via the supply-chain vector: any integration that\nautomatically names entities (e.g. energy providers like Tibber) could deliver the payload\nwithout requiring the attacker to have any account on the target Home Assistant instance. This\nmirrors the exact attack path described in CVE-2025-62172. The most likely exploit is also through energy providers due to them providing multiple entities compatible with statistic graphs.\n\nCompared to CVE-2025-62172, this has the requirement that you add a Statistics Graph to your dashboard (or somehow view the entity in a Statistics Graph through other means, if such a method exists). Otherwise the attack flow is identical.\nSuggested CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\n\nThe root cause — missing `filterXSS()` on `param.seriesName` — is identical to the already-fixed\nEnergy dashboard. The Statistics Graph card, which uses a shared `statistics-chart` component,\nwas not included in the previous fix scope.\n\nCredit: Robin Lunde - [https://robinlunde.com](https://robinlunde.com)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "homeassistant"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "2026.7.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/frontend/pull/52235"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/home-assistant/core"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/home-assistant/core/releases/tag/2026.7.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-80" ],
    "severity" : "CRITICAL",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-22T20:40:55Z",
    "nvd_published_at" : null
  }
}