Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field, which is then executed when any user hovers over data points in the energy dashboard graph tooltips. The vulnerability exists because entity names containing HTML are not properly sanitized before being rendered in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. Additionally, if an energy provider (such as Tibber) supplies a malicious default name for an entity, the vulnerability can be exploited without direct user action when the default name is used. This issue has been patched in version 2025.10.2. No known workarounds exist.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| home-assistant | core | 2025.1.0 to before 2025.10.2 | 2025.10.2 | Patch available | CNA |
| — | homeassistant (PyPI) | 2025.1.0 to before 2025.10.2 | 2025.10.2 | Patch available | GHSA-mq77-rv97-285m |
- core Vendorhome-assistant Affected 2025.1.0 to before 2025.10.2 Fixed in 2025.10.2 Patch available CNA
- homeassistant (PyPI) Vendor— Affected 2025.1.0 to before 2025.10.2 Fixed in 2025.10.2 Patch available GHSA-mq77-rv97-285m
Remediation
- Fix · CNA core (home-assistant) Fixed in 2025.10.2
- Fix · GHSA-mq77-rv97-285m homeassistant (PyPI) Fixed in 2025.10.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-62172
- 2026-10-03 Alias added: GHSA-mq77-rv97-285m
References
Other 6
- https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m
- https://github.com/home-assistant/core
- https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/common/entity/compute_state_name.ts
- https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/data/recorder.ts#L329-L339
- https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/panels/lovelace/cards/energy/hui-energy-devices-graph-card.ts#L110
- https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/panels/lovelace/cards/energy/hui-energy-usage-graph-card.ts#L467-L478
More home-assistant vulnerabilities
- TI-2023-12210 Improper authentication in home-assistant core CVSS 3.1CRITICAL 10.0
- TI-2021-22555 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover CVSS 4.0HIGH 8.7
- TI-2026-61899 Home Assistant: XSS in Statistics Graph Card CVSS 4.0CRITICAL 9.3
- TI-2026-46349 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore CVSS 4.0CRITICAL 9.3
- TI-2026-40307 Cleartext transmission of sensitive information in home-assistant core CVSS 3.1HIGH 7.5
- TI-2026-25491 Home Assistant has stored XSS in history-graphs CVSS 4.0HIGH 7.3
Sources
- CVE-2025-62172 · CVE Program
- CVE-2025-62172 · NVD
- FIRST EPSS
- GHSA-mq77-rv97-285m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences