CVE-2026-91130
CriticalCVSS 9.3Summary
Prior to 2026.7.0, the Statistics Graph card in Home Assistant passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration supplying a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point.
Risk Assessment
Malicious script execution in the victim's browser could lead to session or account compromise.
Recommendation
Update Home Assistant to version 2026.7.0 or later, which fixes this vulnerability.
Other vulnerabilities in Home Assistant
See all- CVE-2026-91129Medium
Home Assistant is open source home automation software. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated _ipp._tcp.local mDNS announcements in config_flow.py, where async_step_zeroconf passed attacker-controlled host, port, and base_path to validate_input for printer metadata retrieval. Because the shared HTTP client followed attacker-controlled cross-origin redirects without blocking loopback targets, a local-network attacker could redirect requests to 127.0.0.1 or other internal services without user interaction. Fixed in 2026.2.3.
- CVE-2026-66061High
Prior to version 2026.5.0, the Home Assistant Companion app for iOS treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue has been fixed in version 2026.5.0.
- CVE-2026-66060High
Prior to version 2026.5.3, the Home Assistant Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user. As a result, any untrusted app on the device can forward an arbitrary tag to Home Assistant, causing it to execute the associated automation as though a legitimate user had scanned an authorized tag. This allows silent, unattended automation execution by untrusted local callers. This issue is fixed in version 2026.8.1.
- CVE-2026-59717Medium
Home Assistant before version 2026.6.1 has an open redirect vulnerability in the Android Companion app. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft an invite that leads to a look-alike login page capturing credentials.
- CVE-2026-55844High
The Home Assistant iOS companion app ignores the SSID allowlist for internal networks. When no other URL is found, it falls back to the internal URL, potentially exposing the user's token on an unsecured network.
Original NVD description (English source)
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.