EUVD-2026-84803
GHSA-wx4m-69m9-gx3m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Authenticated actor or malicious integration must plant the name (PR:L) and a viewer must hover (UI:R); script runs in the victim's browser context (S:C) enabling session/data theft (C:H) and limited actions (I:L), with no availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
5Blast Radius
ecosystem impact- 3 pypi packages depend on homeassistant (3 direct, 0 indirect)
Ecosystem-wide dependent count for version 2026.7.0.
DescriptionCVE.org
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.
AnalysisAI
Stored/DOM cross-site scripting in the Home Assistant frontend Statistics Graph card lets an authenticated user or a malicious integration inject script-related HTML through an entity's default name, which is passed through getStatisticLabel and computeStateName and interpolated unescaped into ECharts tooltip HTML. The payload renders only when a separate victim hovers over an affected data point in a default Line chart (Bar charts are not affected), so exploitation needs low-privilege authenticated access plus victim interaction, and is therefore rated CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N rather than the vendor-published 9.3 base. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the Statistics Graph card configured as a default Line chart displaying Mean, State, Sum, or Change fields (Bar charts are explicitly NOT affected). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a stored/DOM cross-site scripting flaw (CWE-80) in the Home Assistant frontend Statistics Graph card, where entity names flow through getStatisticLabel/computeStateName and are interpolated into ECharts tooltip HTML without escaping. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade Home Assistant core to 2026.7.0 or later (https://github.com/home-assistant/core/releases/tag/2026.7.0), which incorporates the frontend fix from commit b8c201b6d34414d30c622797366570185c219614 and https://github.com/home-assistant/frontend/pull/52235; consult GHSA-wx4m-69m9-gx3m for the vendor's official guidance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Home Assistant deployments and restrict access to trusted users, and if the vendor patch is not immediately deployable, disable the Statistics Graph card or avoid Line charts by using Bar charts as a temporary workaround. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Home Assistant
View allhomeassistant is an open source home automation tool. Rated critical severity (CVSS 10.0), this vulnerability is remotel
Home Assistant Community Store (HACS) 1.10.0 contains a path traversal vulnerability that allows unauthenticated attacke
Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
Home assistant is an open source home automation. Rated critical severity (CVSS 9.6), this vulnerability is remotely exp
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply
Home Assistant before 2021.1.3 does not have a protection layer that can help to prevent directory-traversal attacks aga
Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled fil
Home assistant is an open source home automation. Rated critical severity (CVSS 9.0), this vulnerability is remotely exp
The Home Assistant Companion for iOS and macOS app up to version 2023.4 are vulnerable to Client-Side Request Forgery. R
Stored cross-site scripting in the Home Assistant Energy dashboard (versions 2025.1.0 through 2025.10.1) lets an authent
Cross-origin JavaScript injection in Home Assistant Companion apps for Android (before 2026.4.4) and iOS (before 2026.4.
Home Assistant is open source home automation software. Rated medium severity (CVSS 4.3), this vulnerability is no authe
Same weakness CWE-80 – Basic XSS
View allShare
External POC / Exploit Code
Leaving vuln.today