Home Assistant
CVE-2025-62172
HIGH
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated attacker stores payload (PR:L); victim must hover to trigger (UI:R); XSS executes in another user's browser so scope changes (S:C), enabling session/home-automation control (C:H/I:H), no direct availability impact (A:N).
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action when the default name is used. This issue has been patched in version 2025.10.2. No known workarounds exist.
AnalysisAI
Stored cross-site scripting in the Home Assistant Energy dashboard (versions 2025.1.0 through 2025.10.1) lets an authenticated user embed HTML/JavaScript in an energy entity's name field, which is rendered unsanitized in the graph tooltip and executes when any user hovers over a data point. The same weakness is reachable without a local attacker account if an energy-provider integration such as Tibber supplies a malicious default entity name, and according to the reporter it can affect any entity with an HTML entity in its name that is rendered in the graph view. As of this analysis there is no CISA KEV listing and no public exploit identified; EPSS is low at 0.42% (34th percentile), and the assessment is that this is a genuine but conditionally-gated issue requiring authentication for the direct vector plus victim hover interaction, rather than a drop-everything emergency. A vendor patch exists in 2025.10.2.
Technical ContextAI
The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation / cross-site scripting), specifically a stored XSS in the Home Assistant frontend Energy dashboard. Per the GitHub advisory, the offending code is in src/panels/lovelace/cards/energy/hui-energy-devices-graph-card.ts, where a tooltip string is built with a template literal of the form ${title}${params.marker} ${params.seriesName}: ${value}; the seriesName value derives from the entity's power/energy name and, failing that, the friendly_name, and the only transformation applied is replacing underscores with spaces via _computeObjectId(entityId).replace(/_/g, " "). Because no HTML escaping is performed before the value is interpolated into tooltip markup, an entity name containing HTML is parsed as markup in the browser, and the payload executes in the context of the session viewing the dashboard. The affected distribution package is pip/homeassistant, vulnerable in the range >= 2025.1.0 and <= 2025.10.1. The vulnerability is scoped to the browsing session of users viewing the Energy dashboard rather than to the Home Assistant server or its automation engine, and the reporter notes the issue is not limited to the Energy integration itself - the user-controlled entity name path is generic, and provider-supplied default names (for example from Tibber) can deliver the payload without a local actor.
Affected ProductsAI
Home Assistant (pip/homeassistant) versions 2025.1.0 through 2025.10.1 inclusive are vulnerable; version 2025.10.2 contains the fix. The affected component is the frontend Energy dashboard graph card (hui-energy-devices-graph-card.ts) as distributed in the home-assistant/core repository, and per the reporter any entity whose name contains an HTML entity and is rendered in the graph view is in scope, including entities surfaced through third-party energy providers such as the Tibber integration whose default entity names may be attacker- or provider-controlled. No CPE strings were supplied with the source data, so product identification relies on the pip package range and the vendor advisory at https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m.
RemediationAI
Vendor-released patch: upgrade Home Assistant to version 2025.10.2 or later, which is the only complete fix and the only remediation the advisory endorses - the advisory states no known workarounds exist and the independent assessment confirms nothing short of upgrading to 2025.10.2 resolves it. Because deployment guidance does not exist beyond the upgrade, organizations that cannot immediately patch should reduce exposure by restricting which accounts hold permissions to create or rename energy entities and by reviewing and cleansing entity names and friendly names for markup (this is a partial control, since a provider-supplied default name such as one from the Tibber integration can deliver the payload without any local rename and would not be covered by permission tightening; the trade-off is loss of flexibility in who can manage the energy configuration). Avoiding or disabling untrusted third-party energy-provider integrations that populate default entity names removes the no-interaction provider vector but sacrifices the provider's data feed. Until the upgrade is applied, treat Energy dashboard sessions as at risk and consider limiting who routinely views the dashboard, accepting that this does not prevent exploitation and only narrows the population of sessions a stored payload can hit. Validate the fix in a staging instance before fleet-wide rollout and consult the vendor advisory at https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m for any updates.
More in Home Assistant
View allhomeassistant is an open source home automation tool. Rated critical severity (CVSS 10.0), this vulnerability is remotel
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a mal
Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attacke
Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply
Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks aga
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled fil
Home assistant is an open source home automation. Rated critical severity (CVSS 9.0), this vulnerability is remotely exp
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. R
Cross-origin JavaScript injection in Home Assistant Companion apps for Android (before 2026.4.4) and iOS (before 2026.4.
Home Assistant is open source home automation software. Rated medium severity (CVSS 4.3), this vulnerability is no authe
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today