CVE-2026-91130

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-91130
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91130.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-91130
Aliases
Published
2026-09-22T19:02:38Z
Modified
2026-10-28T02:30:48Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
Home Assistant: XSS in Statistics Graph Card
Details

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the Statistics Graph card in src/components/chart/statistics-chart.ts passed entity names through getStatisticLabel and computeStateName and interpolated param.seriesName into ECharts tooltip HTML without escaping. An authenticated user or an integration that supplies a malicious default entity name could cause script-related HTML to execute when a viewer hovered over a data point. Mean, State, Sum, and Change fields in the default Line chart configuration were affected, while Bar charts were not. This issue is fixed in version 2026.7.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91130.json"
}
References

Affected packages

Git / github.com/home-assistant/core

Affected ranges

Type
GIT
Repo
https://github.com/home-assistant/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f474e1d59a97bf3aae4cb8ccf3bc5a0895419851
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2026.7.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "original_tag": "2026.7.0",
            "range": [
                {
                    "fixed": "f474e1d59a97bf3aae4cb8ccf3bc5a0895419851"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2026.7.0"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}
Type
GIT
Repo
https://github.com/home-assistant/frontend
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b8c201b6d34414d30c622797366570185c219614
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "fixed": "b8c201b6d34414d30c622797366570185c219614"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.103.0
0.103.0b0
0.103.0b1
0.103.1
0.103.2
0.103.3
0.103.4
0.103.5
0.103.6
0.104.0
0.104.1
0.104.2
0.104.3
0.105.0
0.105.1
0.105.2
0.105.3
0.105.4
0.105.5
0.106.0
0.106.1
0.106.2
0.106.3
0.106.4
0.106.5
0.106.6
0.107.0
0.107.1
0.107.2
0.107.3
0.107.4
0.107.5
0.107.6
0.107.7
0.108.0
0.108.1
0.108.2
0.108.3
0.108.4
0.108.5
0.108.6
0.108.7
0.108.8
0.108.9
0.109.0
0.109.1
0.109.2
0.109.3
0.109.4
0.109.5
0.109.6
0.110.0
0.110.1
0.110.2
0.110.3
0.110.4
0.110.5
0.110.6
0.110.7
0.111.0
0.111.1
0.111.2
0.111.3
0.111.4
0.112.0
0.112.1
0.112.2
0.112.3
0.112.4
0.112.5
0.113.0
0.113.1
0.113.2
0.113.3
0.114.0
0.114.1
0.114.2
0.114.3
0.114.4
0.115.0
0.115.1
0.115.2
0.115.3
0.115.4
0.115.5
0.115.6
0.116.0
0.116.1
0.116.2
0.116.3
0.116.4
0.117.0
0.117.1
0.117.2
0.117.3
0.117.4
0.117.5
0.117.6
0.118.0
0.118.1
0.118.2
0.118.3
0.118.4
0.118.5
0.28
0.7.6
0.81.1
20171102.*
20171102.0
20171105.*
20171105.0
20180710.*
20180710.0
20180717.*
20180717.0
20180718.*
20180718.0
20180719.*
20180719.0
20180720.*
20180720.0
20180724.*
20180724.0
20180726.*
20180726.0
20180802.*
20180802.0
20180803.*
20180803.0
20180804.*
20180804.0
20180811.*
20180811.0
20180816.*
20180816.1
20180818.*
20180818.0
20180820.*
20180820.0
20180825.*
20180825.0
20180826.*
20180826.0
20180827.*
20180827.0
20180829.*
20180829.0
20180829.1
20180831.*
20180831.0
20180903.*
20180903.0
20180911.*
20180911.0
20180912.*
20180912.0
20180917.*
20180917.0
20180919.*
20180919.0
20180920.*
20180920.0
20180926.*
20180926.0
20180927.*
20180927.0
20181002.*
20181002.0
20181005.*
20181005.0
20181007.*
20181007.0
20181012.*
20181012.0
20181014.*
20181014.0
20181017.*
20181017.0
20181018.*
20181018.0
20181021.*
20181021.0
20181023.*
20181023.0
20181024.*
20181024.0
20181026.*
20181026.0
20181030.*
20181030.0
20181107.*
20181107.0
20181112.*
20181112.0
20181121.*
20181121.0
20181126.*
20181126.0
20181219.*
20181219.0
20190113.*
20190113.0
20190115.*
20190115.0
20190121.*
20190121.0
20190121.1
20190130.*
20190130.1
20190201.*
20190201.0
20190202.*
20190202.0
20190203.*
20190203.0
20190212.*
20190212.0
20190216.*
20190216.0
20190218.*
20190218.0
20190219.*
20190219.0
20190220.*
20190220.0
20190227.*
20190227.0
20190228.*
20190228.0
20190303.*
20190303.0
20190305.*
20190305.0
20190305.1
20190312.*
20190312.0
20190313.*
20190313.0
20190315.*
20190315.0
20190315.1
20190316.*
20190316.0
20190319.*
20190319.0
20190320.*
20190320.0
20190321.*
20190321.0
20190327.*
20190327.0
20190329.*
20190329.0
20190331.*
20190331.0
20190410.*
20190410.0
20190417.*
20190417.0
20190419.*
20190419.0
20190424.*
20190424.0
20190427.*
20190427.0
20190502.*
20190502.0
20190507.*
20190507.0
20190508.*
20190508.0
20190509.*
20190509.0
20190510.*
20190510.0
20190514.*
20190514.0
20190523.*
20190523.0
20190529.*
20190529.0
20190530.*
20190530.0
20190601.*
20190601.0
20190602.*
20190602.0
20190604.*
20190604.0
20190614.*
20190614.0
20190618.*
20190618.0
20190619.*
20190619.0
20190620.*
20190620.0
20190624.*
20190624.0
20190624.1
20190626.*
20190626.0
20190627.*
20190627.0
20190630.*
20190630.0
20190702.*
20190702.0
20190705.*
20190705.0
20190710.*
20190710.0
20190712.*
20190712.0
20190715.*
20190715.0
20190717.*
20190717.0
20190717.1
20190718.*
20190718.0
2020.*
2020.12.0
2020.12.1
2020.12.2
20200418.*
20200418.0
20200617.*
20200617.0
20200824.*
20200824.0
2021.*
2021.1.0
2021.1.1
2021.1.2
2021.1.3
2021.1.4
2021.1.5
2021.10.0
2021.10.1
2021.10.2
2021.10.3
2021.10.4
2021.10.5
2021.10.6
2021.10.7
2021.11.0
2021.11.1
2021.11.2
2021.11.3
2021.11.4
2021.11.5
2021.12.0
2021.12.1
2021.12.10
2021.12.2
2021.12.3
2021.12.4
2021.12.5
2021.12.6
2021.12.7
2021.12.8
2021.12.9
2021.2.0
2021.2.1
2021.2.2
2021.2.3
2021.3.0
2021.3.1
2021.3.2
2021.3.3
2021.3.4
2021.4.0
2021.4.1
2021.4.2
2021.4.3
2021.4.4
2021.4.5
2021.4.6
2021.5.0
2021.5.1
2021.5.2
2021.5.3
2021.5.4
2021.5.5
2021.6.0
2021.6.1
2021.6.2
2021.6.3
2021.6.4
2021.6.5
2021.6.6
2021.7.0
2021.7.1
2021.7.2
2021.7.3
2021.7.4
2021.8.0
2021.8.1
2021.8.2
2021.8.3
2021.8.4
2021.8.5
2021.8.6
2021.8.7
2021.8.8
2021.9.0
2021.9.1
2021.9.2
2021.9.3
2021.9.4
2021.9.5
2021.9.6
2021.9.7
20210302.*
20210302.2
20210313.*
20210313.0
20210314.*
20210314.0
20210316.*
20210316.0
20210324.*
20210324.0
20210328.*
20210328.0
20210330.*
20210330.0
20210416.*
20210416.0
20210423.*
20210423.0
20210427.*
20210427.0
20210517.*
20210517.0
20210518.*
20210518.0
20210727.*
20210727.0
20210728.*
20210728.0
20210729.*
20210729.0
20210813.*
20210813.0
20210818.*
20210818.0
20210825.*
20210825.0
20210911.*
20210911.0
20210922.*
20210922.0
20211014.*
20211014.0
20211020.*
20211020.0
20211117.*
20211117.0
20211123.*
20211123.0
20211130.*
20211130.0
20211201.*
20211201.0
20211202.*
20211202.0
2022.*
2022.10.0
2022.10.1
2022.10.2
2022.10.3
2022.10.4
2022.10.5
2022.11.0
2022.11.1
2022.11.2
2022.11.3
2022.11.4
2022.11.5
2022.12.0
2022.12.1
2022.12.2
2022.12.3
2022.12.4
2022.12.5
2022.12.6
2022.12.7
2022.12.8
2022.12.9
2022.2.0
2022.2.1
2022.2.2
2022.2.3
2022.2.4
2022.2.5
2022.2.6
2022.2.7
2022.2.8
2022.2.9
2022.3.0
2022.3.1
2022.3.2
2022.3.3
2022.3.4
2022.3.5
2022.3.6
2022.3.7
2022.3.8
2022.4.0
2022.4.1
2022.4.2
2022.4.3
2022.4.4
2022.4.5
2022.4.6
2022.4.7
2022.5.0
2022.5.1
2022.5.2
2022.5.3
2022.5.4
2022.5.5
2022.6.0
2022.6.1
2022.6.2
2022.6.3
2022.6.4
2022.6.5
2022.6.6
2022.6.7
2022.7.0
2022.7.1
2022.7.2
2022.7.3
2022.7.4
2022.7.5
2022.7.6
2022.7.7
2022.8.0
2022.8.1
2022.8.2
2022.8.3
2022.8.4
2022.8.5
2022.8.6
2022.8.7
2022.9.0
2022.9.1
2022.9.2
2022.9.3
2022.9.4
2022.9.5
2022.9.6
2022.9.7
20220118.*
20220118.0
20220124.*
20220124.0
20220214.*
20220214.0
20220220.*
20220220.0
20220222.*
20220222.0
20220312.*
20220312.0
20220316.*
20220316.0
20220317.*
20220317.0
20220322.*
20220322.0
20220329.*
20220329.0
20220420.*
20220420.0
20220424.*
20220424.0
20220425.*
20220425.0
20220427.*
20220427.0
20220428.*
20220428.0
20220429.*
20220429.0
20220502.*
20220502.0
20220516.*
20220516.0
20220518.*
20220518.0
20220521.*
20220521.0
20220523.*
20220523.0
20220524.*
20220524.0
20220525.*
20220525.0
20220624.*
20220624.0
20220816.*
20220816.0
20220907.*
20220907.0
20221020.*
20221020.0
20221021.*
20221021.0
2023.*
2023.1.0
2023.1.1
2023.1.2
2023.1.3
2023.1.4
2023.1.5
2023.1.6
2023.1.7
2023.10.0
2023.10.1
2023.10.2
2023.10.3
2023.10.4
2023.10.5
2023.11.0
2023.11.1
2023.11.2
2023.11.3
2023.12.0
2023.12.1
2023.12.2
2023.12.3
2023.12.4
2023.2.0
2023.2.1
2023.2.2
2023.2.3
2023.2.4
2023.2.5
2023.3.0
2023.3.1
2023.3.2
2023.3.3
2023.3.4
2023.3.5
2023.3.6
2023.4.0
2023.4.1
2023.4.2
2023.4.3
2023.4.4
2023.4.5
2023.4.6
2023.5.0
2023.5.1
2023.5.2
2023.5.3
2023.5.4
2023.6.0
2023.6.1
2023.6.2
2023.6.3
2023.7.0
2023.7.1
2023.7.2
2023.7.3
2023.8.0
2023.8.1
2023.8.2
2023.8.3
2023.8.4
2023.9.0
2023.9.1
2023.9.2
2023.9.3
20230526.*
20230526.0
20230628.*
20230628.0
20230705.*
20230705.0
2024.*
2024.1.0
2024.1.1
2024.1.2
2024.1.3
2024.1.4
2024.1.5
2024.1.6
2024.10.0
2024.10.1
2024.10.2
2024.10.3
2024.11.0
2024.11.1
2024.11.2
2024.11.3
2024.12.0
2024.12.1
2024.12.2
2024.12.3
2024.12.4
2024.12.5
2024.2.0
2024.2.1
2024.2.2
2024.2.3
2024.2.4
2024.2.5
2024.3.0
2024.3.1
2024.3.2
2024.3.3
2024.4.0
2024.4.1
2024.4.2
2024.4.3
2024.4.4
2024.5.0
2024.5.1
2024.5.2
2024.5.3
2024.5.4
2024.5.5
2024.6.0
2024.6.1
2024.6.2
2024.6.3
2024.6.4
2024.7.0
2024.7.1
2024.7.2
2024.7.3
2024.7.4
2024.8.0
2024.8.1
2024.8.2
2024.8.3
2024.9.0
2024.9.1
2024.9.2
2024.9.3
20240112.*
20240112.0
20240125.*
20240125.0
20240719.*
20240719.0
20241010.*
20241010.0
2025.*
2025.1.0
2025.1.1
2025.1.2
2025.1.3
2025.1.4
2025.10.0
2025.10.1
2025.10.2
2025.10.3
2025.10.4
2025.11.0
2025.11.1
2025.11.2
2025.11.3
2025.12.0
2025.12.1
2025.12.2
2025.12.3
2025.12.4
2025.12.5
2025.2.0
2025.2.1
2025.2.2
2025.2.3
2025.2.4
2025.2.5
2025.3.0
2025.3.1
2025.3.2
2025.3.3
2025.3.4
2025.4.0
2025.4.1
2025.4.2
2025.4.3
2025.4.4
2025.5.0
2025.5.1
2025.5.2
2025.5.3
2025.6.0
2025.6.1
2025.6.2
2025.6.3
2025.7.0
2025.7.1
2025.7.2
2025.7.3
2025.7.4
2025.8.0
2025.8.1
2025.8.2
2025.8.3
2025.9.0
2025.9.1
2025.9.2
2025.9.3
2025.9.4
20250129.*
20250129.0
20250226.*
20250226.0
20250326.*
20250326.0
20250625.*
20250625.0
20250730.*
20250730.0
20250827.*
20250827.0
20251029.*
20251029.0
2026.*
2026.1.0
2026.1.1
2026.1.2
2026.1.3
2026.2.0
2026.2.1
2026.2.2
2026.2.3
2026.3.0
2026.3.1
2026.3.2
2026.3.3
2026.3.4
2026.4.0
2026.4.1
2026.4.2
2026.4.3
2026.4.4
2026.5.0
2026.5.1
2026.5.2
2026.5.3
2026.5.4
2026.6.0
2026.6.1
2026.6.2
2026.6.3
2026.6.4
20260128.*
20260128.0
20260325.*
20260325.0
20260527.*
20260527.0
Other
Last-Python2-release
fix/DropdownBackground
untagged-8e3b39fce881285ad68d
untagged-9f9e4e2b641de669333f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91130.json"