Home Assistant: XSS in Statistics Graph Card

Date Sep 22, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product PyPI · homeassistant

CVE CVE-2026-91130

Critical vendor advisory CVE-2026-91130

Summary

Home Assistant: XSS in Statistics Graph Card

Why it matters

GitHub has published a reviewed security advisory for homeassistant. Prioritize it with other application dependency updates.

Operator check

Check whether homeassistant is present in application dependency manifests, lockfiles, or build images. Review the GitHub advisory and upgrade to a patched version where available. CVSS score: 9.3.

Sources

GitHub Advisory GHSA-wx4m-69m9-gx3m NVD — CVE-2026-91130 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed