CVE-2026-91130

### Summary An authenticated party can add a malicious name to any statistics-capable entity, allowing for Cross-Site Scripting attacks against anyone who views a Statistics Graph card containing that entity, when they hover over any data point on the chart. **Payload** <img width="1529" height="441" alt="image" src="https://github.com/user-attachments/assets/6926ce53-75fb-455a-bd4e-0c5281e8bed8" /> **Payload triggering** <img width="835" height="469" alt="image" src="https://github.com/user-attachments/assets/0bb9d17a-c123-4d44-8471-35097f65ddd2" /> An alternative, and more impactful scenario, is that the entity gets a malicious name from the provider of the integration (e.g. Tibber, Shelly, or any HACS integration), and is exploited that way through the default name — without requiring any direct access to the Home Assistant instance. This is the same supply-chain vector as CVE-2025-62172. ### Details The Statistics Graph card renders entity names in ECharts tooltips as raw HTML. The offending line is in `src/components/chart/statistics-chart.ts`: https://github.com/home-assistant/frontend/blob/c13a80ce5e7ae39f0262444e2b6295a074a96732/src/components/chart/statistics-chart.ts#L236 Where **_`param.seriesName`_** is interpolated verbatim into the returned HTML string: ``` return `${time}${param.marker} ${param.seriesName}: ${value}`; ``` No call to `filterXSS()` is made — unlike the Energy dashboard chart, which was patched as part of CVE-2025-62172: ``` // FIXED in energy-chart-options.ts:268 return `${param.marker} ${filterXSS(param.seriesName!)}: ...`; ``` The `statistics-chart` component was not updated when the Energy chart was patched, leaving the same class of vulnerability in place. The existing entity and payload used for CVE-2025-62172 is also a valid exploit for this vulnerability: <img width="962" height="500" alt="image" src="https://github.com/user-attachments/assets/35c84dcd-64d4-47b6-8df2-6c8b63cac880" /> The name value flows through th