Listen to this Post
CVE-2026-91130 is a stored cross-site scripting (XSS) vulnerability affecting the Statistics Graph card in Home Assistant versions prior to 2026.7.0. The flaw resides in src/components/chart/statistics-chart.ts, where entity names are passed through `getStatisticLabel` and `computeStateName` and then interpolated into the ECharts tooltip HTML without any escaping. The offending line is return \${time}${param.marker} ${param.seriesName}: ${value}`;, which mirrors the exact pattern previously patched in the Energy dashboard under CVE-2025-62172. Unlike the Energy chart, which was updated to wrap `param.seriesName` withfilterXSS(), the shared `statistics-chart` component was never updated, leaving the same class of vulnerability in place. An authenticated user can add a malicious name to any statistics-capable entity, or an integration that automatically supplies entity names—such as Tibber, Shelly, or any HACS integration—can deliver the payload through a default name without requiring any direct access to the target instance. This supply-chain vector is identical to the one described in CVE-2025-62172. The vulnerability affects the Mean, State, Sum, and Change fields in the default Line chart configuration, while Bar charts are not affected. When a viewer hovers over a data point on a Statistics Graph card, the malicious script executes in their browser, potentially leading to session hijacking, data exfiltration, or full compromise of the Home Assistant instance. The root cause—missing `filterXSS()` onparam.seriesName`—is identical to the already-fixed Energy dashboard, and the Statistics Graph card was simply omitted from the previous fix scope.
DailyCVE Form:
Platform: Home Assistant
Version: < 2026.7.0
Vulnerability : Stored XSS
Severity: Critical
date: 2026-09-22
Prediction: 2026-07-01
What Undercode Say:
Vulnerable code in statistics-chart.ts
return <code>${time}${param.marker} ${param.seriesName}: ${value}</code>;
Fixed code in energy-chart-options.ts (CVE-2025-62172)
return <code>${param.marker} ${filterXSS(param.seriesName!)}: ...</code>;
PoC payload test <img src=x onerror=alert(document.domain) />
Exploit: (Educational Purposes!)
- In Settings → Devices & Services → Helpers, click + Create Helper.
- Choose Template → Template sensor. Fill in the form:
– Name: `test `
– State template: `{{0.00000001as_timestamp(states(‘sensor.date_time_iso’))}}`
– Unit of measurement: kWh
– State class: Measurement
– Click Submit.
3. Open a dashboard and add a Statistics Graph card targeting the new sensor.
4. Set time-window to 5 minutes for ease of testing.
5. Hover over any data point on the chart. The `onerror` handler fires—alert(document.domain) executes in the browser.
Protection: from this CVE
Upgrade to Home Assistant version 2026.7.0 or later. Sanitize all entity names before rendering in tooltips. Apply `filterXSS()` to `param.seriesName` in statistics-chart.ts. Audit all integrations that automatically name entities, especially energy providers and HACS integrations.
Impact:
Remote code execution via supply-chain vector. Any integration that automatically names entities can deliver the payload without requiring an attacker to have an account on the target instance. The most likely exploit path is through energy providers due to them providing multiple entities compatible with Statistics Graphs. Successful exploitation can lead to session hijacking, data exfiltration, and full compromise of the Home Assistant instance.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
