Vulnerability in homeassistant (CVE-2026-91130)
Summary
Vulnerability in homeassistant (CVE-2026-91130). Risk of unauthorized operations or information disclosure. Exploitable via param.seriesName. Mitigation: upgrade to 2026.7.0 or later.
Original description
The description as published by the source.
Summary
An authenticated party can add a malicious name to any statistics-capable entity, allowing for
Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that
entity, when they hover over any data point on the chart.
Payload
Payload triggering
An alternative, and more impactful scenario, is that the entity gets a malicious name from the
provider of the integration (e.g. Tibber, Shelly, or any HACS integration), and is exploited
that way through the default name — without requiring any direct access to the Home Assistant
instance. This is the same supply-chain vector as CVE-2025-62172.
Details
The Statistics Graph card renders entity names in ECharts tooltips as raw HTML. The offending
line is in src/components/chart/statistics-chart.ts:
Where param.seriesName is interpolated verbatim into the returned HTML string:
return `${time}${param.marker} ${param.seriesName}: ${value}`;
No call to filterXSS() is made — unlike the Energy dashboard chart, which was patched as part
of CVE-2025-62172:
// FIXED in energy-chart-options.ts:268
return `${param.marker} ${filterXSS(param.seriesName!)}: ...`;
The statistics-chart component was not updated when the Energy chart was patched, leaving the
same class of vulnerability in place.
The existing entity and payload…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-91130 has been found in homeassistant.
Attackers can target a specific entry point like param.seriesName over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade homeassistant to 2026.7.0 or later.
If unsure, ask your IT team or search "homeassistant CVE-2026-91130" on the vendor's site.
CVE-2026-91130 (homeassistant) — CWE-80
Attack surface: param.seriesName / name / getStatisticLabel / computeStateName
Patched: 2026.7.0 — apply immediately
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-80) exists in homeassistant. Attackers reach the vulnerable code path via param.seriesName.
Check the vendor advisory for the affected versions of homeassistant. Attack surface: param.seriesName / name / getStatisticLabel / computeStateName.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 2026.7.0.
Until the patch is applied: disable the affected feature, apply WAF rules, or restrict access via network ACLs.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'homeassistant' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'homeassistant' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
homeassistantを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply patch patch
Upgrade homeassistant to 2026.7.0ステージング環境で 2026.7.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
3Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- web github.com
- web github.com
- web github.com
- web github.com
- web github.com