Skip to main content

Home Assistant CVE-2026-91130

| EUVDEUVD-2026-84803 CRITICAL
Basic XSS (CWE-80)
2026-09-22 security-advisories@github.com GHSA-wx4m-69m9-gx3m
XSS Home Assistant
9.3
CVSS 4.0 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
9.3 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.6 HIGH

Authenticated actor or malicious integration must plant the name (PR:L) and a viewer must hover (UI:R); script runs in the victim's browser context (S:C) enabling session/data theft (C:H) and limited actions (I:L), with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
A
Scope
X

Lifecycle Timeline

5
POC Analysis Generated
Sep 22, 2026 - 23:23 vuln.today
Metadata Corrected
Sep 22, 2026 - 20:40 vuln.today
tag: Home Assistant added
Patch available
Sep 22, 2026 - 20:18 EUVD
Analysis Generated
Sep 22, 2026 - 19:40 vuln.today
CVE Published
Sep 22, 2026 - 19:16 cve.org
CRITICAL 9.3

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3 pypi packages depend on homeassistant (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 2026.7.0.

DescriptionCVE.org

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

AnalysisAI

Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires the Statistics Graph card configured as a default Line chart displaying Mean, State, Sum, or Change fields (Bar charts are explicitly NOT affected). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a stored/DOM cross-site scripting flaw (CWE-80) in the Home Assistant frontend Statistics Graph card, where entity names flow through getStatisticLabel/computeStateName and are interpolated into ECharts tooltip HTML without escaping. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Vendor-released patch: upgrade Home Assistant core to 2026.7.0 or later (https://github.com/home-assistant/core/releases/tag/2026.7.0), which incorporates the frontend fix from commit b8c201b6d34414d30c622797366570185c219614 and https://github.com/home-assistant/frontend/pull/52235; consult GHSA-wx4m-69m9-gx3m for the vendor's official guidance. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all Home Assistant deployments and restrict access to trusted users, and if the vendor patch is not immediately deployable, disable the Statistics Graph card or avoid Line charts by using Bar charts as a temporary workaround. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Home Assistant

View all
CVE-2023-27482 CRITICAL POC
10.0 Mar 08

homeassistant is an open source home automation tool. Rated critical severity (CVSS 10.0), this vulnerability is remotel
CVE-2021-47942 HIGH POC
8.7 May 16

Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attacke
CVE-2023-41897 CRITICAL
9.6 Oct 19

Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
CVE-2023-41895 CRITICAL
9.6 Oct 19

Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
CVE-2026-64824 CRITICAL
9.3 Jul 21

Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply
CVE-2021-3152 MEDIUM POC
5.3 Jan 26

Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks aga
CVE-2026-64825 CRITICAL
9.0 Jul 21

Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled fil
CVE-2023-41896 CRITICAL
9.0 Oct 19

Home assistant is an open source home automation. Rated critical severity (CVSS 9.0), this vulnerability is remotely exp
CVE-2023-44385 HIGH
8.8 Oct 19

The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. R
CVE-2025-62172 HIGH
8.5 Oct 14

Stored cross-site scripting in the Home Assistant Energy dashboard (versions 2025.1.0 through 2025.10.1) lets an authent
CVE-2026-44698 HIGH
8.3 May 29

Cross-origin JavaScript injection in Home Assistant Companion apps for Android (before 2026.4.4) and iOS (before 2026.4.
CVE-2023-50715 MEDIUM POC
4.3 Dec 15

Home Assistant is open source home automation software. Rated medium severity (CVSS 4.3), this vulnerability is no authe

Same weakness CWE-80 – Basic XSS

View all
CVE-2025-30210 HIGH POC
8.7
CVE-2025-66450 HIGH POC
8.6
CVE-2025-30161 HIGH POC
8.4
CVE-2024-32484 HIGH POC
8.2
CVE-2026-2995 HIGH POC
7.7
CVE-2024-25639 HIGH POC
7.5
CVE-2022-0989 HIGH POC
7.5
CVE-2024-34507 HIGH POC
7.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-91130 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy