{"uuid": "e5d0c17a-2e97-44ae-aa31-ed0c42edeaf6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-91130", "type": "seen", "source": "https://gist.github.com/alon710/4c2c1021543d93cf5f79daddff3b5a00", "content": "# CVE-2026-91130: CVE-2026-91130: DOM-Based Cross-Site Scripting in Home Assistant Statistics Graph Card\n\n> **CVSS Score:** 9.3\n> **Published:** 2026-09-22\n> **Full Report:** https://cvereports.com/reports/CVE-2026-91130\n\n## Summary\nCVE-2026-91130 is a critical DOM-based Cross-Site Scripting (XSS) vulnerability in the Home Assistant open-source home automation platform. Prior to version 2026.7.0, the Statistics Graph card rendered series tooltips using raw HTML string interpolation without escaping user-controlled entity friendly names. By abusing this vulnerability, an authenticated user with low-privilege access can inject arbitrary HTML and JavaScript into entity name fields, which executes in the context of an administrative user's browser session upon hovering over a data point on an affected chart.\n\n## TL;DR\nUnescaped entity friendly names in Home Assistant Statistics Graph tooltips allow DOM-based XSS, leading to potential administrative session hijacking.\n\n## Technical Details\n\n- **CWE ID**: CWE-80\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 9.3 (Critical)\n- **Required Privilege**: Low (PR:L)\n- **User Interaction**: Active (UI:A)\n- **Exploit Status**: Proof-of-Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Home Assistant Core\n- Home Assistant Frontend\n- **Home Assistant Core**: < 2026.7.0 (Fixed in: `2026.7.0`)\n\n## Mitigation\n\n- Upgrade Home Assistant Core to version 2026.7.0 or newer\n- Restrict configuration and dashboard editing access to trusted administrators\n- Sanitize or audit third-party integration entity registrations\n\n**Remediation Steps:**\n1. Check current software version in the Home Assistant settings panel.\n2. Download and apply the Core update to version 2026.7.0.\n3. Audit the SQLite or PostgreSQL database for persistent states containing script tags.\n\n## References\n\n- [GitHub Security Advisory GHSA-wx4m-69m9-gx3m](https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m)\n- [GitHub Pull Request #52235](https://github.com/home-assistant/frontend/pull/52235)\n- [Fix Commit b8c201b](https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614)\n- [Home Assistant 2026.7.0 Release Notes](https://github.com/home-assistant/core/releases/tag/2026.7.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-91130) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T21:32:14.674980Z"}