Home Assistant core versions >= 2025.02 and < 2026.01 contain a CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability in the "remaining charge time" sensor for mobile phones. This sensor, apparently imported from Android Auto, does not properly sanitize input, leading to a cross-site scripting vulnerability similar to CVE-2025-62172. The vulnerability has a CVSS 4.0 base score of 7.3, indicating high severity, with network attack vector, low attack complexity, and partial privileges required. The vulnerability is resolved in version 2026.01.

Successful exploitation of this XSS vulnerability could allow an attacker to execute arbitrary scripts in the context of the Home Assistant web interface, potentially leading to unauthorized actions or data exposure within the affected environment. The CVSS score of 7.3 reflects a high impact with high confidentiality, integrity, and availability impacts. However, no known exploits in the wild have been reported as of the publication date.

Upgrade Home Assistant core to version 2026.01 or later, where this vulnerability has been fixed. Since this is not a cloud service, remediation depends on the user applying the update. Patch status is confirmed by the vendor advisory indicating the fix is included in version 2026.01. No additional mitigation steps are specified.