CVE-2026-91130: CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card

#security #cve #cybersecurity

CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card

Vulnerability ID: CVE-2026-91130
CVSS Score: 9.3
Published: 2026-09-22

CVE-2026-91130 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Home Assistant open-source home automation platform. Prior to version 2026.7.0, the Statistics Graph card rendered series tooltips using raw HTML string interpolation without escaping user-controlled entity friendly names. By abusing this vulnerability, an authenticated user with low-privilege access can inject arbitrary HTML and JavaScript into entity name fields, which executes in the context of an administrative user's browser session upon hovering over a data point on an affected chart.

TL;DR

Unescaped entity friendly names in Home Assistant Statistics Graph tooltips allow DOM-based XSS, leading to potential administrative session hijacking.

Technical Details

CWE ID: CWE-80
Attack Vector: Network (AV:N)
CVSS v4.0 Score: 9.3 (Critical)
Required Privilege: Low (PR:L)
User Interaction: Active (UI:A)
Exploit Status: Proof-of-Concept
KEV Status: Not Listed

Affected Systems

Home Assistant Core
Home Assistant Frontend
Home Assistant Core: < 2026.7.0 (Fixed in: 2026.7.0)

Mitigation Strategies

Upgrade Home Assistant Core to version 2026.7.0 or newer
Restrict configuration and dashboard editing access to trusted administrators
Sanitize or audit third-party integration entity registrations

Remediation Steps:

Check current software version in the Home Assistant settings panel.
Download and apply the Core update to version 2026.7.0.
Audit the SQLite or PostgreSQL database for persistent states containing script tags.

References

Read the full report for CVE-2026-91130 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community