fkie_cve-2026-91130

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

GHSA-wx4m-69m9-gx3m — Home Assistant: XSS in Statistics Graph Card

Affected: PyPI: homeassistant

### Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart.

**Payload** <img width="1529" height="441" alt="image" src="https://github.com/user-attachments/assets/6926ce53-75fb-455a-bd4e-0c5281e8bed8" />

**Payload triggering** <img width="835" height="469" alt="image" src="https://github.com/user-attachments/assets/0bb9d17a-c123-4d44-8471-35097f65ddd2" />

An alternative, and more impactful scenario, is that the entity gets a malicious name from the provider of the integration (e.g. Tibber, Shelly, or any HACS integration), and is exploited that way through the default name — without requiring any direct access to the Home Assistant instance. This is the same supply-chain vector as CVE-2025-62172.

### Details

The Statistics Graph card renders entity names in ECharts tooltips as raw HTML. The offending line is in `src/components/chart/statistics-chart.ts`:

https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/components/chart/statistics-chart.ts#L236

Where **_`param.seriesName`_** is interpolated verbatim into the returned HTML string:

``` return `${time}${param.marker} ${param.seriesName}: ${value}`; ```

No call to `filterXSS()` is made — unlike the Energy dashboard chart, which was patched as part of CVE-2025-62172:

``` // FIXED i…

Most recent entries from all

fkie_cve-2026-91130

GHSA-wx4m-69m9-gx3m — Home Assistant: XSS in Statistics Graph Card