Home Assistant core versions >= 2020.02 and < 2026.01 contain an improper neutralization of input during web page generation (CWE-79) vulnerability. Authenticated users can add a malicious name to a device entity, which leads to Cross-Site Scripting attacks against other users viewing dashboards with Map-cards that include the compromised entity. The attack vector requires user interaction (hovering over an information point). The issue is resolved in version 2026.01.

Successful exploitation allows an authenticated user to execute arbitrary scripts in the context of other users viewing the affected dashboard, potentially leading to session hijacking, unauthorized actions, or data exposure. The attack requires victim interaction (hovering) and authenticated attacker presence to inject the malicious entity name.

Upgrade Home Assistant core to version 2026.01 or later, where this vulnerability is fixed. Since this is an authenticated attack vector, restricting user permissions may reduce risk but does not fully mitigate the issue. Patch status is confirmed fixed in version 2026.01.