{"id":"CVE-2026-91130","summary":"Home Assistant: XSS in Statistics Graph Card","details":"Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.","aliases":["GHSA-wx4m-69m9-gx3m"],"modified":"2026-09-24T03:48:20.131203677Z","published":"2026-09-22T19:02:38.916Z","database_specific":{"cwe_ids":["CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91130.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/home-assistant/core/releases/tag/2026.7.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91130.json"},{"type":"ADVISORY","url":"https://github.com/home-assistant/core/security/advisories/GHSA-wx4m-69m9-gx3m"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91130"},{"type":"FIX","url":"https://github.com/home-assistant/frontend/commit/b8c201b6d34414d30c622797366570185c219614"},{"type":"FIX","url":"https://github.com/home-assistant/frontend/pull/52235"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/home-assistant/core","events":[{"introduced":"0"},{"fixed":"f474e1d59a97bf3aae4cb8ccf3bc5a0895419851"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2026.7.0"}],"source":["AFFECTED_FIELD","REFERENCES"]}},{"type":"GIT","repo":"https://github.com/home-assistant/frontend","events":[{"introduced":"0"},{"fixed":"b8c201b6d34414d30c622797366570185c219614"}],"database_specific":{"source":"REFERENCES"}}],"versions":["2026.6.4","2026.6.3","2026.6.2","2026.6.1","2026.6.0","2026.5.4","2026.5.3","2026.5.2","2026.5.1","2026.5.0","2026.4.4","2026.4.3","2026.4.2","2026.4.1","2026.4.0","2026.3.4","2026.3.3","2026.3.2","2026.3.1","2026.3.0","2026.2.3","2026.2.2","2026.2.1","2026.2.0","2026.1.3","2026.1.2","2026.1.1","2026.1.0","2025.12.5","2025.12.4","2025.12.3","2025.12.2","2025.12.1","2025.12.0","2025.11.3","2025.11.2","2025.11.1","2025.11.0","2025.10.4","2025.10.3","2025.10.2","2025.10.1","2025.10.0","2025.9.4","2025.9.3","2025.9.2","2025.9.1","2025.9.0","2025.8.3","2025.8.2","2025.8.1","2025.8.0","2025.7.4","2025.7.3","2025.7.2","2025.7.1","2025.7.0","2025.6.3","2025.6.2","2025.6.1","2025.6.0","2025.5.3","2025.5.2","2025.5.1","2025.5.0","2025.4.4","2025.4.3","2025.4.2","2025.4.1","2025.4.0","2025.3.4","2025.3.3","2025.3.2","2025.3.1","2025.3.0","2025.2.5","2025.2.4","2025.2.3","2025.2.2","2025.2.1","2025.2.0","2025.1.4","2025.1.3","2025.1.2","2025.1.1","2025.1.0","2024.12.5","2024.12.4","2024.12.3","2024.12.2","2024.12.1","2024.12.0","2024.11.3","2024.11.2","2024.11.1","2024.11.0","2024.10.3","2024.10.2","2024.10.1","2024.10.0","2024.9.3","2024.9.2","2024.9.1","2024.9.0","2024.8.3","2024.8.2","2024.8.1","2024.8.0","2024.7.4","2024.7.3","2024.7.2","2024.7.1","2024.7.0","2024.6.4","2024.6.3","2024.6.2","2024.6.1","2024.6.0","2024.5.5","2024.5.4","2024.5.3","2024.5.2","2024.5.1","2024.5.0","2024.4.4","2024.4.3","2024.4.2","2024.4.1","2024.4.0","2024.3.3","2024.3.2","2024.3.1","2024.3.0","2024.2.5","2024.2.4","2024.2.3","2024.2.2","2024.2.1","2024.2.0","2024.1.6","2024.1.5","2024.1.4","2024.1.3","2024.1.2","2024.1.1","2024.1.0","2023.12.4","2023.12.3","2023.12.2","2023.12.1","2023.12.0","2023.11.3","2023.11.2","2023.11.1","2023.11.0","2023.10.5","2023.10.4","2023.10.3","2023.10.2","2023.10.1","2023.10.0","2023.9.3","2023.9.2","2023.9.1","2023.9.0","2023.8.4","2023.8.3","2023.8.2","2023.8.1","2023.8.0","2023.7.3","2023.7.2","2023.7.1","2023.7.0","2023.6.3","2023.6.2","2023.6.1","2023.6.0","2023.5.4","2023.5.3","2023.5.2","2023.5.1","2023.5.0","2023.4.6","2023.4.5","2023.4.4","2023.4.3","2023.4.2","2023.4.1","2023.4.0","2023.3.6","2023.3.5","2023.3.4","2023.3.3","2023.3.2","2023.3.1","2023.3.0","2023.2.5","2023.2.4","2023.2.3","2023.2.2","2023.2.1","2023.2.0","2023.1.7","2023.1.6","2023.1.5","2023.1.4","2023.1.3","2023.1.2","2023.1.1","2023.1.0","2022.12.9","2022.12.8","2022.12.7","2022.12.6","2022.12.5","2022.12.4","2022.12.3","2022.12.2","2022.12.1","2022.12.0","2022.11.5","2022.11.4","2022.11.3","2022.11.2","2022.11.1","2022.11.0","2022.10.5","2022.10.4","2022.10.3","2022.10.2","2022.10.1","2022.10.0","2022.9.7","2022.9.6","2022.9.5","2022.9.4","2022.9.3","2022.9.2","2022.9.1","2022.9.0","2022.8.7","2022.8.6","2022.8.5","2022.8.4","2022.8.3","2022.8.2","2022.8.1","2022.8.0","2022.7.7","2022.7.6","2022.7.5","2022.7.4","2022.7.3","2022.7.2","2022.7.1","2022.7.0","2022.6.7","2022.6.6","2022.6.5","2022.6.4","2022.6.3","2022.6.2","2022.6.1","2022.6.0","2022.5.5","2022.5.4","2022.5.3","2022.5.2","2022.5.1","2022.5.0","2022.4.7","2022.4.6","2022.4.5","2022.4.4","2022.4.3","2022.4.2","2022.4.1","2022.4.0","2022.3.8","2022.3.7","2022.3.6","2022.3.5","2022.3.4","2022.3.3","2022.3.2","2022.3.1","2022.3.0","2022.2.9","2022.2.8","2022.2.7","2022.2.6","2022.2.5","2022.2.4","2022.2.3","2022.2.2","2022.2.1","2022.2.0","2021.12.10","2021.12.9","2021.12.8","2021.12.7","2021.12.6","2021.12.5","2021.12.4","2021.12.3","2021.12.2","2021.12.1","2021.12.0","2021.11.5","2021.11.4","2021.11.3","2021.11.2","2021.11.1","2021.11.0","2021.10.7","2021.10.6","2021.10.5","2021.10.4","2021.10.3","2021.10.2","2021.10.1","2021.10.0","2021.9.7","2021.9.6","2021.9.5","2021.9.4","2021.9.3","2021.9.2","2021.9.1","2021.9.0","2021.8.8","2021.8.7","2021.8.6","2021.8.5","2021.8.4","2021.8.3","2021.8.2","2021.8.1","2021.8.0","2021.7.4","2021.7.3","2021.7.2","2021.7.1","2021.7.0","2021.6.6","2021.6.5","2021.6.4","2021.6.3","2021.6.2","2021.6.1","2021.6.0","2021.5.5","2021.5.4","2021.5.3","2021.5.2","2021.5.1","2021.5.0","2021.4.6","2021.4.5","2021.4.4","2021.4.3","2021.4.2","2021.4.1","2021.4.0","2021.3.4","2021.3.3","2021.3.2","2021.3.1","2021.3.0","2021.2.3","2021.2.2","2021.2.1","2021.2.0","2021.1.5","2021.1.4","2021.1.3","2021.1.2","2021.1.1","2021.1.0","2020.12.2","2020.12.1","2020.12.0","0.118.5","0.118.4","0.118.3","0.118.2","0.118.1","0.118.0","0.117.6","0.117.5","0.117.4","0.117.3","0.117.2","0.117.1","0.117.0","0.116.4","0.116.3","0.116.2","0.116.1","0.116.0","0.115.6","0.115.5","0.115.4","0.115.3","0.115.2","0.115.1","0.115.0","0.114.4","0.114.3","0.114.2","0.114.1","0.114.0","0.113.3","0.113.2","0.113.1","0.113.0","0.112.5","0.112.4","0.112.3","0.112.2","0.112.1","0.112.0","0.111.4","0.111.3","0.111.2","0.111.1","0.111.0","0.110.7","0.110.6","0.110.5","0.110.4","0.110.3","0.110.2","0.110.1","0.110.0","0.109.6","0.109.5","0.109.4","0.109.3","0.109.2","0.109.1","0.109.0","0.108.9","0.108.8","0.108.7","0.108.6","0.108.5","0.108.4","0.108.3","0.108.2","0.108.1","0.108.0","0.107.7","0.107.6","0.107.5","0.107.4","0.107.3","0.107.2","0.107.1","0.107.0","0.106.6","0.106.5","0.106.4","0.106.3","0.106.2","0.106.1","0.106.0","0.105.5","0.105.4","0.105.3","0.105.2","0.105.1","0.105.0","0.104.3","0.104.2","0.104.1","0.104.0","0.103.6","0.103.5","0.103.4","0.103.3","0.103.2","0.103.1","0.103.0","0.103.0b1","0.103.0b0","0.81.1","0.28","0.7.6","Last-Python2-release","20260527.0","20260325.0","20260128.0","20251029.0","20250827.0","20250730.0","20250625.0","20250326.0","20250226.0","20250129.0","20241010.0","20240719.0","fix/DropdownBackground","20240125.0","20240112.0","untagged-8e3b39fce881285ad68d","20230705.0","20230628.0","20230526.0","20221021.0","20221020.0","20220907.0","20220816.0","20220624.0","20220525.0","20220524.0","20220523.0","20220521.0","20220518.0","20220516.0","20220502.0","20220429.0","20220428.0","20220427.0","20220425.0","20220424.0","20220420.0","20220329.0","20220322.0","20220317.0","20220316.0","20220312.0","20220222.0","20220220.0","20220214.0","20220124.0","20220118.0","20211202.0","20211201.0","20211130.0","20211123.0","20211117.0","20211020.0","20211014.0","20210922.0","20210911.0","20210825.0","20210818.0","20210813.0","20210729.0","20210728.0","20210727.0","20210518.0","20210517.0","20210427.0","20210423.0","20210416.0","20210330.0","20210328.0","20210324.0","20210316.0","20210314.0","20210313.0","20210302.2","20200824.0","20200617.0","20200418.0","untagged-9f9e4e2b641de669333f","20190718.0","20190717.1","20190717.0","20190715.0","20190712.0","20190710.0","20190705.0","20190702.0","20190630.0","20190627.0","20190626.0","20190624.1","20190624.0","20190620.0","20190619.0","20190618.0","20190614.0","20190604.0","20190602.0","20190601.0","20190530.0","20190529.0","20190523.0","20190514.0","20190510.0","20190509.0","20190508.0","20190507.0","20190502.0","20190427.0","20190424.0","20190419.0","20190417.0","20190410.0","20190331.0","20190329.0","20190327.0","20190321.0","20190320.0","20190319.0","20190316.0","20190315.1","20190315.0","20190313.0","20190312.0","20190305.1","20190305.0","20190303.0","20190228.0","20190227.0","20190220.0","20190219.0","20190218.0","20190216.0","20190212.0","20190203.0","20190202.0","20190201.0","20190130.1","20190121.1","20190121.0","20190115.0","20190113.0","20181219.0","20181126.0","20181121.0","20181112.0","20181107.0","20181030.0","20181026.0","20181024.0","20181023.0","20181021.0","20181018.0","20181017.0","20181014.0","20181012.0","20181007.0","20181005.0","20181002.0","20180927.0","20180926.0","20180920.0","20180919.0","20180917.0","20180912.0","20180911.0","20180903.0","20180831.0","20180829.1","20180829.0","20180827.0","20180826.0","20180825.0","20180820.0","20180818.0","20180816.1","20180811.0","20180804.0","20180803.0","20180802.0","20180726.0","20180724.0","20180720.0","20180719.0","20180718.0","20180717.0","20180710.0","20171105.0","20171102.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91130.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}]}