---
id: CVE-2026-91130
title: >-
  Home Assistant is open source home automation software focused on local
  control and privacy
summary: >-
  Home Assistant is open source home automation software focused on local
  control and privacy. Prior to 2026.7.0, the Statistics Graph card in
  src/components/chart/statistics-chart.ts passed entity names through
  getStatisticLabel and compu…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cwe:
  - CWE-80
vendor: homeassistant
product: homeassistant
affected:
  - homeassistant < 2026.7.0
patched:
  - homeassistant 2026.7.0
published: '2026-09-22'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T18:12:04.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-91130'
references:
  - url: 'https://github.com/home-assistant/core/releases/tag/2026.7.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m
    label: security-advisories@github.com
  - url: >-
      https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614
    label: security-advisories@github.com
  - url: 'https://github.com/home-assistant/frontend/pull/52235'
    label: security-advisories@github.com
  - url: >-
      https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-wx4m-69m9-gx3m'
  - url: 'https://github.com/home-assistant/core'
tags:
  - nvd
  - ghsa
  - pip
  - cve.org
  - exploit-available
  - osv
epss: 0.00386
epssPercentile: 0.29907
aliases:
  - GHSA-wx4m-69m9-gx3m
ecosystem: pip
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-22T19:39:45.840965Z'
cvssSource: cna
ingestedAt: '2026-09-22T20:10:15.091Z'
---

## Overview

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-91130)

Affected packages:

- `homeassistant < 2026.7.0`

Patched in:

- `homeassistant 2026.7.0`

Source: https://github.com/advisories/GHSA-wx4m-69m9-gx3m