CVE-2025-62172

Advisory

Affected versions of the homeassistant package are vulnerable to Cross-site Scripting (XSS) due to improper neutralization of HTML in entity names rendered by the Energy dashboard tooltip. In the frontend’s Energy graph cards, the tooltip formatter returns ${title}${params.marker} ${params.seriesName}: ${value} without escaping params.seriesName, which is sourced from getStatisticLabel(...) → computeStateName(...) and can include attacker-controlled markup from entity names.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-mq77-rv97-285m
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62172