CVE-2026-91130: Home Assistant Statistics Graph XSS Vulnerability

CVE-2026-91130 Overview

CVE-2026-91130 is a stored cross-site scripting (XSS) vulnerability in Home Assistant, the open source home automation platform. The flaw resides in the Statistics Graph card component located in src/components/chart/statistics-chart.ts. Entity names retrieved through getStatisticLabel and computeStateName were interpolated into ECharts tooltip HTML without proper escaping. An authenticated user or a compromised integration supplying a malicious default entity name can inject script-related HTML that executes when a viewer hovers over a data point on the chart. The Mean, State, Sum, and Change fields in the default Line chart configuration are affected. Bar charts are not vulnerable. The issue is fixed in version 2026.7.0.

Critical Impact
Authenticated attackers can inject persistent XSS payloads through entity names, executing arbitrary JavaScript in the browser context of any Home Assistant user viewing an affected Statistics Graph card.

Affected Products

Home Assistant Core (frontend component) prior to version 2026.7.0
Statistics Graph card in Line chart configuration (Mean, State, Sum, Change fields)
Home Assistant integrations that supply user-controllable default entity names

Discovery Timeline

2026-09-22 - CVE-2026-91130 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-91130

Vulnerability Analysis

The vulnerability is classified as an improper neutralization of script-related HTML tags in a web page [CWE-80]. Home Assistant's frontend renders Statistics Graph cards using the ECharts library. When constructing tooltip HTML for the Line chart configuration, the frontend concatenated raw entity names and param.seriesName values directly into HTML strings. Because ECharts renders tooltips as HTML rather than text by default, any embedded markup is parsed and executed by the browser.

An authenticated user with permission to create or rename entities, or an integration that programmatically supplies a default entity name, can embed script-carrying HTML in a device or entity name. The payload triggers when another user, including an administrator, hovers over a data point on an affected chart.

Root Cause

The root cause is unsafe string interpolation into an HTML sink. The getStatisticLabel and computeStateName helpers returned entity display names that were then concatenated into ECharts tooltip templates using template literals. No sanitization or encoding was applied before the string reached the HTML renderer. The Bar chart tooltip path did not use the same unsafe interpolation and therefore was not affected.

Attack Vector

Exploitation requires authenticated access to submit an entity name containing malicious HTML, or control of an integration that populates entity metadata. Because the payload is stored server-side and executes on any subsequent tooltip render, it functions as a stored XSS. User interaction (hovering) is required to trigger execution.

typescript

// Patch fragment: replaced unsafe HTML string tooltips with Lit templates
// Source: https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614

import type { PropertyValues } from "lit";
import { css, LitElement, nothing } from "lit";
import { customElement, property } from "lit/decorators";

@customElement("ha-chart-tooltip-marker")
class HaChartTooltipMarker extends LitElement {
  @property() public color = "";

  @property({ type: Boolean, reflect: true }) public rtl = false;

  protected willUpdate(changed: PropertyValues) {
    if (changed.has("color")) {
      this.style.backgroundColor = this.color;
    }
  }

  protected render() {
    return nothing;
  }
}

The fix replaces raw HTML string construction with Lit templates. Lit automatically escapes interpolated values, neutralizing script-carrying content in entity names. See the Home Assistant Frontend Commit for full context.

Detection Methods for CVE-2026-91130

Indicators of Compromise

Home Assistant entities whose names contain HTML tags such as <img>, <svg>, <script>, or event handler attributes like onerror= and onload=.
Unexpected outbound HTTP requests originating from the Home Assistant web UI browser session during dashboard viewing.
Newly created or renamed entities from integrations that accept remote metadata immediately preceding suspicious browser activity.

Detection Strategies

Audit the Home Assistant entity registry for names containing angle brackets, quote characters, or JavaScript event handler substrings.
Review integration configuration sources that populate entity names, particularly integrations bridging to remote or user-controlled services.
Inspect browser console logs and Content Security Policy violation reports collected from clients accessing dashboards with Statistics Graph cards.

Monitoring Recommendations

Log and alert on entity create and rename events sourced from non-administrative users or newly installed integrations.
Monitor Home Assistant frontend version across deployments and flag any instance running a release prior to 2026.7.0.
Capture browser telemetry from clients that regularly view Statistics dashboards to identify anomalous script execution.

How to Mitigate CVE-2026-91130

Immediate Actions Required

Upgrade Home Assistant to version 2026.7.0 or later, which replaces unsafe tooltip HTML with escaped Lit templates.
Audit existing entity names and rename any entity containing HTML markup or event handler syntax.
Restrict authenticated access and review integration installations to confirm only trusted sources can supply entity metadata.

Patch Information

The vulnerability is fixed in Home Assistant 2026.7.0. The frontend patch is tracked in Home Assistant Frontend Pull Request #52235 and committed as b8c201b. Full advisory details are available in GitHub Security Advisory GHSA-wx4m-69m9-gx3m and the Home Assistant Release 2026.7.0 notes.

Workarounds

Remove or replace Statistics Graph cards using Line chart configuration until the upgrade is applied.
Switch affected dashboard cards to Bar chart configuration, which is not vulnerable to the tooltip injection.
Limit dashboard access to trusted administrators and disable non-essential integrations that accept external entity name input.

bash

# Upgrade Home Assistant Core to the patched version
# Container deployment example
docker pull ghcr.io/home-assistant/home-assistant:2026.7.0
docker stop homeassistant
docker rm homeassistant
docker run -d --name homeassistant \
  --restart=unless-stopped \
  -v /PATH_TO_YOUR_CONFIG:/config \
  --network=host \
  ghcr.io/home-assistant/home-assistant:2026.7.0