CVE-2026-91130: Home Assistant: XSS in Statistics Graph Card
An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart.
Payload
Payload triggering
An alternative, and more impactful scenario, is that the entity gets a malicious name from the provider of the integration (e.g. Tibber, Shelly, or any HACS integration), and is exploited that way through the default name — without requiring any direct access to the Home Assistant instance. This is the same supply-chain vector as CVE-2025-62172.
References
- github.com/advisories/GHSA-wx4m-69m9-gx3m
- github.com/home-assistant/core/releases/tag/2026.7.0
- github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m
- github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614
- github.com/home-assistant/frontend/pull/52235
- nvd.nist.gov/vuln/detail/CVE-2026-91130
Code Behaviors & Features
Detect and mitigate CVE-2026-91130 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →