Product
Home Assistant contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-91130) in the Statistics Graph card, allowing arbitrary JavaScript execution when viewing entities with malicious names.