Home Assistant Statistics Graph Card Vulnerable to Stored XSS via Entity Names (CVE-2026-91130)

A newly disclosed GitHub Security Advisory (GHSA-wx4m-69m9-gx3m, tracked as CVE-2026-91130) describes a cross-site scripting flaw in Home Assistant's frontend Statistics Graph card. According to the advisory, the card renders entity names verbatim into ECharts tooltip HTML in src/components/chart/statistics-chart.ts, without passing the value through the filterXSS() sanitizer that is applied elsewhere in the codebase. Malicious HTML placed in an entity's name executes when a user hovers over a data point on the chart.

What was reported

The advisory states the name value flows from computeStateName() through getStatisticLabel() into the tooltip renderer with no HTML encoding at any step — only underscore-to-space substitution is applied. The researcher notes this is the same root cause and exploitation pattern as the previously patched CVE-2025-62172 in the Energy dashboard chart, but the fix for that issue was not extended to the Statistics Graph card's shared statistics-chart component. A public proof-of-concept is included in the advisory, using a template sensor with a malicious name (e.g. containing an <img> payload).

Why it matters

Two exploitation paths are described. The first requires an authenticated user to set a malicious entity name directly. The second — flagged by the reporter as more impactful — requires no access to the instance at all: an integration provider (the advisory names Tibber and Shelly as examples, plus any HACS integration) could assign a malicious default name to an entity it creates, and the payload fires for any user who views that entity in a Statistics Graph card. This is a supply-chain-style vector affecting any Home Assistant deployment that uses default Statistics Graph settings, since the vulnerable summary fields (Mean, State, Sum, Change) and Line chart type are the defaults.

What defenders should watch for now

• Treat entity names/labels originating from third-party integrations as untrusted input when reviewing dashboards, especially energy-provider integrations and community (HACS) integrations.
• Audit dashboards for Statistics Graph cards and check which entities and fields (Mean/State/Sum/Change) they display; consider temporarily switching to Bar chart type or non-affected summary fields as a stopgap, per the advisory's own analysis of what's exploitable.
• Review browser-side logging or EDR/browser telemetry for unexpected script execution or DOM manipulation originating from the Home Assistant frontend origin.
• Track vendor patch status for Home Assistant core/frontend and apply updates once available, since this advisory does not yet confirm a shipped fix.
• For integration developers, ensure any user- or provider-supplied entity name is validated/sanitized before display, not just at the two chart components already known to be affected.

This is a same-day advisory and details, including patch availability, may evolve. This analysis reflects only the information published in the GitHub Security Advisory as of now; see the original source for the full technical writeup, proof-of-concept, and updates: GHSA-wx4m-69m9-gx3m.