PT-2025-41968 · Unknown · Home Assistant

Published 2025-10-14 · Updated 2025-10-16 · CVE-2025-62172

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Home Assistant versions 2025.1.0 through 2025.10.1

Description Home Assistant is home automation software that prioritizes local control and privacy. The energy dashboard is susceptible to stored cross-site scripting. An authenticated user can inject malicious JavaScript code into an energy entity's name field. This code is then executed when any user hovers over data points in the energy dashboard graph tooltips. The issue occurs because entity names containing HTML are not properly sanitized before rendering in graph tooltips. This could allow an attacker with authentication to execute arbitrary JavaScript in the context of other users' sessions. If an energy provider supplies a malicious default name for an entity, the issue can be exploited without direct user action when the default name is used.

Recommendations Update to Home Assistant version 2025.10.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2025-62172

GHSA-MQ77-RV97-285M

Affected Products

Home Assistant

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62172.json · Exploit
• https://osv.dev/vulnerability/GHSA-mq77-rv97-285m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62172 · Security Note
• https://github.com/home-assistant/core · Note
• https://github.com/home-assistant/core/security/advisories/GHSA-mq77-rv97-285m · Note
• https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/common/entity/compute_state_name.ts · Note
• https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/panels/lovelace/cards/energy/hui-energy-usage-graph-card.ts#L467-L478 · Note
• https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/panels/lovelace/cards/energy/hui-energy-devices-graph-card.ts#L110 · Note
• https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/data/recorder.ts#L329-L339 · Note
• https://twitter.com/pwn_panda/status/1978203432696610944 · Twitter Post
• https://twitter.com/CVEnew/status/1978932613105750140 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1o87w9u/resumen_diario_de_vulnerabilidades_16102025 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1o7bmsg/resumen_diario_de_vulnerabilidades_15102025 · Reddit Post