Attack Chain

1. An attacker identifies a target Home Assistant instance or a third-party integration utilized by target users.
2. The attacker crafts a payload containing malicious HTML/JavaScript within an entity name string (e.g., <img src=x onerror=alert(document.domain) />).
3. If via supply chain, the attacker compromises a third-party integration or uses a malicious integration to inject the payload into the Home Assistant entity database.
4. If via direct access, an authenticated attacker creates a "Template sensor" helper with the malicious name.
5. The target user adds a Statistics Graph card to their dashboard, configured to display the malicious entity.
6. The victim navigates to the dashboard and interacts with the chart by hovering over a data point.
7. The statistics-chart component renders the unsanitized entity name into the ECharts tooltip, triggering the malicious script execution.
8. The script executes within the context of the victim's authenticated browser session, leading to potential account compromise or further actions.

Impact

The vulnerability allows for remote code execution within the victim's browser context. If exploited via the supply-chain vector, an attacker does not require direct access to the target's Home Assistant instance to deliver the payload. Successful exploitation grants the attacker the ability to perform actions on behalf of the authenticated user, potentially leading to unauthorized control over smart home devices, exfiltration of configuration data, or further internal network reconnaissance.

Recommendation

Prioritized actions for administrators:

• Upgrade Home Assistant to version 2026.7.0 or later immediately to patch CVE-2026-91130.
• Review all third-party integrations and custom sensors for unexpected or anomalous entity names.
• Audit existing dashboard Statistics Graph cards for any entities displaying irregular naming conventions.