CVE-2025-62172
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Home Assistant is open source home automation software. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action. This issue has been patched in version 2025.10.2.
Risk Assessment
An attacker can execute malicious scripts in other users' browsers, potentially leading to session theft, account takeover, or other attacks.
Recommendation
Update Home Assistant to version 2025.10.2 or later. Additionally, consider restricting the ability to edit entity names to trusted users only.
Other vulnerabilities in Home Assistant
See all- CVE-2026-91130Critical
Prior to 2026.7.0, the Statistics Graph card in Home Assistant passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration supplying a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point.
- CVE-2026-91129Medium
Home Assistant is open source home automation software. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect requests to 127.0.0.1 or other internal services without user interaction. Fixed in 2026.2.3.
- CVE-2026-66061High
Prior to version 2026.5.0, the Home Assistant Companion app for iOS treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
- CVE-2026-66060High
Prior to version 2026.5.3, the Home Assistant Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
- CVE-2026-59717Medium
Home Assistant before version 2026.6.1 has an open redirect vulnerability in the Android Companion app. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft an invite that leads to a look-alike login page capturing credentials.
- CVE-2026-55844High
The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.
Original NVD description (English source)
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action when the default name is used. This issue has been patched in version 2025.10.2. No known workarounds exist.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS