GHSA-WX4M-69M9-GX3M Home Assistant: XSS in Statistics Graph Card

Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart. Payload Payload triggering An alternative,...

PT-2026-97016

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2026.7.0 Description An authenticated user or a malicious integration provider can execute a Cross-Site Scripting XSS attack against users who view a Statistics Graph card. The issue occurs because the...