Stored XSS in Home Assistant Statistics Graph Card

Home Assistant versions prior to 2026.7.0 are vulnerable to a stored Cross-Site Scripting (XSS) attack via the Statistics Graph card component. The vulnerability exists because the application fails to sanitize entity names before rendering them within ECharts tooltips. Specifically, in src/components/chart/statistics-chart.ts, the param.seriesName variable is interpolated into an HTML string without being passed through the filterXSS() function. This oversight mirrors a similar vulnerability found in the Energy dashboard (CVE-2025-62172), which was previously patched. An attacker can exploit this by setting a malicious name for an entity, either as an authenticated user or through a supply-chain vector via a third-party integration that automatically populates entity names. When an unsuspecting user views a Statistics Graph card containing the compromised entity and hovers over a data point, the malicious JavaScript executes in their browser session.

Attack Chain

1. An attacker identifies a target Home Assistant instance or a third-party integration utilized by target users.
2. The attacker crafts a payload containing malicious HTML/JavaScript within an entity name string (e.g., <img src=x onerror=alert(document.domain) />).
3. If via supply chain, the attacker compromises a third-party integration or uses a malicious integration to inject the payload into the Home Assistant entity database.
4. If via direct access, an authenticated attacker creates a "Template sensor" helper with the malicious name.
5. The target user adds a Statistics Graph card to their dashboard, configured to display the malicious entity.
6. The victim navigates to the dashboard and interacts with the chart by hovering over a data point.
7. The statistics-chart component renders the unsanitized entity name into the ECharts tooltip, triggering the malicious script execution.
8. The script executes within the context of the victim's authenticated browser session, leading to potential account compromise or further actions.

Impact

The vulnerability allows for remote code execution within the victim's browser context. If exploited via the supply-chain vector, an attacker does not require direct access to the target's Home Assistant instance to deliver the payload. Successful exploitation grants the attacker the ability to perform actions on behalf of the authenticated user, potentially leading to unauthorized control over smart home devices, exfiltration of configuration data, or further internal network reconnaissance.

Recommendation

Prioritized actions for administrators:

• Upgrade Home Assistant to version 2026.7.0 or later immediately to patch CVE-2026-91130.
• Review all third-party integrations and custom sensors for unexpected or anomalous entity names.
• Audit existing dashboard Statistics Graph cards for any entities displaying irregular naming conventions.