Home Automation & Smart Living 1 month ago

Home Assistant Statistics Graph Card XSS Vulnerability – Safe Usage Guide

A comprehensive guide covering the critical XSS flaw in Home Assistant's Statistics Graph Card, step‑by‑step mitigation, version checks, entity name audits, and safer alternatives for visualizing sensor data. A comprehensive guide covering the critical XSS flaw in Home Assistant's Statistics Graph Card, step‑by‑step mitigation, version checks, entity name audits, and safer alternatives for visualizing sensor data.

FacebookXReddit

Smart Living

Introduction

If you’re using Home Assistant to manage your smart home, you likely rely on the Statistics Graph Card to visualize data from your sensors and devices. But here’s what you need to know: this visualization tool contains a critical Cross-Site Scripting (XSS) vulnerability that could compromise your smart home security.

This isn’t a theoretical risk. The vulnerability is real, documented, and actively exploitable if you haven’t taken protective measures. Whether you’re monitoring energy consumption, temperature trends, or water usage, understanding this security flaw and implementing immediate safeguards is essential before you continue using this component.

In this comprehensive guide, we’ll walk you through exactly what this vulnerability means for your setup, how to assess your risk level, and what steps to take right now to protect your Home Assistant instance.

What Is the Statistics Graph Card and Why Security Matters

How the Statistics Graph Card Works in Home Assistant

The Statistics Graph Card is a built-in Home Assistant component designed to transform raw sensor data into meaningful visual insights. Instead of staring at numbers, you see beautiful line charts that show trends over time—whether that’s your energy usage climbing during peak hours or your home’s temperature fluctuating throughout the day.

Here’s how it works in practice:

  • Data Collection: Home Assistant collects historical data from your entities (sensors, switches, climate devices, etc.)
  • Chart Rendering: The card uses ECharts, a powerful charting library, to render interactive line graphs
  • Customization: You can adjust time windows, select specific metrics (Mean, State, Sum, Change), and configure display options
  • Real-Time Updates: The visualization updates as new data arrives from your devices

The Statistics Graph Card has become a staple for users who want to understand their smart home’s behavior—especially those focused on energy monitoring, climate control, and resource consumption tracking.

Why This Vulnerability Affects Your Smart Home

The XSS vulnerability in the Statistics Graph Card isn’t just a technical inconvenience—it’s a potential gateway for attackers to inject malicious code into your Home Assistant interface.

Here’s why this matters:

Direct Access to Your Dashboard: If an attacker can inject code through a compromised entity name, they gain execution capabilities within your Home Assistant frontend. This means they could potentially:

  • Steal authentication tokens or session data
  • Modify automation rules without your knowledge
  • Access sensitive information displayed on your dashboard
  • Redirect you to phishing sites or malicious content

Trust Boundary Violation: Your Home Assistant dashboard is supposed to be a trusted environment. A vulnerability here breaks that fundamental security assumption.

Cascading Effects: If your Home Assistant instance controls critical devices (locks, thermostats, security cameras), compromised automation could have real-world consequences.

Who Is Most at Risk

Not everyone faces the same level of exposure. Your risk depends on several factors:

High Risk:

  • Users who expose Home Assistant to the internet without proper authentication
  • Multi-user households where you’ve granted dashboard access to family members
  • Installations with custom integrations or third-party add-ons that create entities with user-controlled names
  • Users who haven’t updated Home Assistant in several months

Medium Risk:

  • Local network-only installations with basic security
  • Single-user setups with strong authentication
  • Users on recent Home Assistant versions but without security patches applied

Lower Risk:

  • Fully isolated Home Assistant instances (no network access)
  • Installations running the latest patched versions
  • Users who don’t actively use Statistics Graph Cards on their dashboards

The XSS Vulnerability: What You Need to Know

How the Cross-Site Scripting Flaw Works

Let’s break down the technical mechanics of this vulnerability in plain language.

The Root Cause: The Statistics Graph Card displays entity names in tooltips when you hover over data points on the chart. However, Home Assistant wasn’t properly sanitizing these entity names before rendering them in the HTML. This means if an entity name contains malicious JavaScript code, that code gets executed in your browser.

A Simplified Example:

Imagine you have an entity named:

sensor.temperature_<img src=x>

When you hover over the Statistics Graph Card, instead of displaying the entity name safely, the browser interprets the HTML/JavaScript and executes the malicious code.

Why This Happens: The vulnerability exists because:

  1. Entity names can technically contain special characters
  2. The Statistics Graph Card tooltip rendering didn’t escape these characters
  3. ECharts, the charting library, rendered the unescaped content as HTML
  4. The browser executed any embedded JavaScript

Attack Vector: An attacker would need to:

  1. Create or modify an entity with a malicious name (through a custom integration, MQTT, or API)
  2. Get you to add a Statistics Graph Card displaying that entity
  3. Wait for you to hover over the chart (triggering the tooltip)
  4. The malicious code executes in your browser context

Which Versions Are Affected

The vulnerability affects Home Assistant versions prior to 2024.1.0 (and potentially earlier patch versions depending on when the fix was backported).

Affected Versions:

  • Home Assistant 2023.12.x and earlier
  • Home Assistant 2023.11.x and earlier
  • All 2023 versions before the final release
  • Potentially earlier 2023 versions

Fixed Versions:

  • Home Assistant 2024.1.0 and later (with proper sanitization implemented)
  • Any version with the specific XSS patch applied

How to Check Your Version:
In Home Assistant, go to Settings → About and note your current version number.

Real-World Attack Scenarios

Understanding how this vulnerability could actually be exploited helps you assess your real risk:

Scenario 1: Compromised Custom Integration
You install a third-party integration that creates custom sensors. The integration has been compromised, and it creates entities with malicious names. When you add a Statistics Graph Card to monitor these sensors, the XSS payload executes when you view your dashboard.

Scenario 2: MQTT Entity Injection
An attacker gains access to your MQTT broker (perhaps through a weak password or exposed port). They publish a new MQTT entity with a malicious name. If you’ve configured Home Assistant to auto-discover MQTT entities and add them to a Statistics Graph Card, you’re vulnerable.

Scenario 3: Shared Dashboard Access
You’ve shared your Home Assistant dashboard with family members. A malicious actor tricks one of them into clicking a link that creates a new entity with an XSS payload. When anyone views the dashboard, the attack executes.

Scenario 4: Supply Chain Attack
A popular Home Assistant add-on or integration is compromised at the source. The update includes code that creates entities with XSS payloads. Users who update and add Statistics Graph Cards are affected.

Immediate Actions to Protect Your System

Don’t wait. If you’re using Home Assistant with Statistics Graph Cards, take these steps today.

Check Your Home Assistant Version and Update Immediately

Step 1: Identify Your Current Version

  1. Open Home Assistant
  2. Navigate to Settings (gear icon)
  3. Select About
  4. Note your current version number

Step 2: Update Home Assistant

If you’re running version 2023.12.x or earlier, update immediately:

For Home Assistant OS (Recommended):

  1. Go to Settings → System → Updates
  2. Click Check for updates
  3. If an update is available, click Install
  4. Home Assistant will restart automatically

For Home Assistant Container:

docker pull homeassistant/home-assistant:latest
docker stop homeassistant
docker rm homeassistant
docker run -d --name homeassistant --restart=unless-stopped -v /path/to/config:/config homeassistant/home-assistant:latest

For Home Assistant Supervised:

  1. Go to Settings → System → Updates
  2. Click Check for updates
  3. Install available updates

For Home Assistant Core:

pip install --upgrade homeassistant
hass --config /path/to/config

Step 3: Verify the Update
After updating, return to Settings → About and confirm you’re now on version 2024.1.0 or later.

Audit Your Dashboard for Statistics Graph Cards

Now that you’re updated, identify all Statistics Graph Cards currently on your dashboards:

Step 1: Access Your Dashboards

  1. Go to Dashboards in the main menu
  2. Open each dashboard you use

Step 2: Identify Statistics Graph Cards
Look for cards that display line charts with data trends. They’ll typically be labeled “Statistics” or show historical data visualization.

Step 3: Document Them
Create a list noting:

  • Which dashboard contains the card
  • Which entities it’s displaying
  • When it was added

Step 4: Check Entity Names
For each Statistics Graph Card, examine the entity names being displayed. Look for any suspicious characters or unusual naming patterns.

Review Entity Names for Suspicious Characters

This is critical. You’re looking for entity names that contain HTML or JavaScript code.

Red Flags to Watch For:

  • Entity names containing < or > characters
  • Names with script, onerror, onclick, or other event handlers
  • Unusual Unicode characters or encoding
  • Names that don’t match your device naming conventions
  • Entities you don’t remember creating

How to Review:

  1. Go to Settings → Devices & Services → Entities
  2. Search for entities you’re unsure about
  3. Click on each entity to view its full name and details
  4. Check the “Integration” field to see where it came from

If You Find Suspicious Entities:

  1. Don’t panic—the entity existing doesn’t mean you’ve been compromised
  2. Note which integration created it
  3. Disable or delete the entity
  4. Investigate the source integration
  5. Consider removing the integration if it’s untrusted

Enable Home Assistant Security Features

Strengthen your Home Assistant security posture with these built-in features:

1. Enable Two-Factor Authentication (2FA)

  1. Go to Settings → Users
  2. Click on your user account
  3. Scroll to Multi-factor Authentication
  4. Click Enable and follow the setup process
  5. Use an authenticator app (Google Authenticator, Authy, etc.)

2. Review User Permissions

  1. Go to Settings → Users
  2. For each user, click to view their permissions
  3. Ensure users only have access to what they need
  4. Remove any unused user accounts

3. Configure Trusted Networks (Optional)
If you’re only accessing Home Assistant locally:

  1. Go to Settings → Users
  2. Enable Trusted Networks for your local IP range
  3. This reduces the need for authentication on your home network

4. Enable Audit Logs

  1. Go to Settings → System → Logs
  2. Monitor for any suspicious activity
  3. Check for unexpected entity creation or modification

5. Review Active Sessions

  1. Go to Settings → Users
  2. Click your user account
  3. Scroll to Active Sessions
  4. Review and revoke any unfamiliar sessions

Securing Your Statistics Graph Card Long-Term

Best Practices for Entity Naming Conventions

Prevent future vulnerabilities by establishing strict entity naming standards:

Naming Convention Rules:

  • Use only alphanumeric characters and underscores
  • Start with a lowercase letter
  • Use descriptive, human-readable names
  • Follow the pattern: domain.device_location_function

Good Examples:

  • sensor.living_room_temperature
  • switch.bedroom_light
  • binary_sensor.front_door_open
  • climate.main_thermostat

Bad Examples (Avoid These):

  • sensor.temp<script> ❌
  • switch.light_@#$% ❌
  • sensor.data'onclick='alert(1) ❌

Implementation:

  1. Document your naming convention in a README file
  2. Share it with anyone who creates custom integrations
  3. Audit existing entities quarterly
  4. Enforce naming standards in any custom code you write

Monitoring and Logging for Suspicious Activity

Continuous monitoring helps you detect attacks early:

1. Enable Detailed Logging
Add this to your configuration.yaml:

logger:
  default: info
  logs:
    homeassistant.components.statistics: debug
    homeassistant.core: debug

2. Monitor Entity Creation
Create an automation to alert you when new entities are created:

automation:
  - alias: "Alert on New Entity Creation"
    trigger:
      platform: event
      event_type: entity_registry_updated
    action:
      service: notify.notify
      data:
        message: "New entity created: {{ trigger.event.data.entity_id }}"

3. Review Logs Regularly

  1. Go to Settings → System → Logs
  2. Check for warnings or errors related to entity creation
  3. Look for repeated failed authentication attempts
  4. Monitor for unusual API calls

4. Set Up Notifications
Configure notifications for security events:

automation:
  - alias: "Security Alert"
    trigger:
      platform: template
      value_template: "{{ states('sensor.failed_login_attempts') | int(0) > 3 }}"
    action:
      service: notify.mobile_app_your_phone
      data:
        message: "Multiple failed login attempts detected"

Regular Security Patch Management

Stay ahead of vulnerabilities with a proactive update strategy:

Weekly Tasks:

  • Check Settings → System → Updates for available patches
  • Review Home Assistant security announcements
  • Monitor your integrations for updates

Monthly Tasks:

  • Update all add-ons and integrations
  • Review security logs
  • Audit user permissions
  • Check for deprecated components

Quarterly Tasks:

  • Full security audit of your setup
  • Review and update entity naming conventions
  • Test backup and restore procedures
  • Update documentation

Automated Updates (Optional):
Enable automatic updates for non-critical patches:

  1. Go to Settings → System → Updates
  2. Enable Auto-update for add-ons
  3. Schedule updates during low-usage times

Access Control and User Permissions

Limit exposure by restricting who can access what:

Principle of Least Privilege:

  • Give users only the permissions they need
  • Remove access when no longer needed
  • Regularly audit who has what access

Permission Levels:

  1. Administrator: Full access (only for you)
  2. Edit: Can modify automations and dashboards (trusted family)
  3. View: Can only view dashboards (guests, children)
  4. None: No access (disabled accounts)

Implementation:

  1. Go to Settings → Users
  2. For each user, click to edit
  3. Under Permissions, select the appropriate level
  4. For granular control, use Advanced Options
Home Assistant settings panel showing user permissions and security configuration options.
Home Assistant settings panel showing user permissions and security configuration options.

Safer Alternatives for Data Visualization

If you’re concerned about the Statistics Graph Card or want more advanced visualization options, consider these alternatives:

Home Assistant Energy Dashboard

What It Is: A built-in dashboard specifically designed for energy monitoring with enhanced security.

Setup:

  1. Go to Settings → Devices & Services → Energy
  2. Click Create Energy Configuration
  3. Add your energy sources (grid, solar, etc.)
  4. Configure energy consumers (devices, circuits)

Benefits:

  • Purpose-built for energy data
  • Better security practices than Statistics Graph Card
  • Automatic calculations and insights
  • No XSS vulnerabilities documented
  • Integrated with Home Assistant core

Limitations:

  • Limited to energy-related data
  • Less customizable than Statistics Graph Card
  • Requires proper entity configuration

Best For: Energy monitoring, solar tracking, consumption analysis

Grafana Integration for Advanced Monitoring

What It Is: A professional-grade visualization platform that connects to Home Assistant.

Setup:

  1. Install Grafana (Docker, standalone, or cloud)
  2. Add Home Assistant as a data source
  3. Create custom dashboards with advanced visualizations
  4. Configure alerts and notifications

Benefits:

  • Enterprise-grade security
  • Highly customizable dashboards
  • Advanced analytics and alerting
  • Separate from Home Assistant (isolated security)
  • Supports multiple data sources

Limitations:

  • Requires additional infrastructure
  • Steeper learning curve
  • More resource-intensive
  • Requires separate authentication

Best For: Advanced analytics, multi-source monitoring, professional setups

Third-Party Visualization Tools

ApexCharts Card:

  • Community-developed card with modern charting
  • More customization than Statistics Graph Card
  • Active maintenance and security updates
  • Installation via HACS (Home Assistant Community Store)

Mini Graph Card:

  • Lightweight alternative for simple visualizations
  • Minimal resource usage
  • Good for mobile dashboards
  • Community-supported

Custom HTML Card:

  • For advanced users who want complete control
  • Use with caution—requires proper sanitization
  • Allows integration with external charting libraries

When to Use Each Alternative

Use Case Recommendation Reason
Energy monitoring Energy Dashboard Purpose-built, secure
Temperature trends Statistics Graph Card (updated) Simple, integrated
Advanced analytics Grafana Professional features
Mobile dashboards Mini Graph Card Lightweight
Custom visualizations ApexCharts Card Flexible, maintained
Multi-source data Grafana Supports multiple sources

Evaluating Risk Before Deployment

Assessing Your Current Setup’s Vulnerability

Use this assessment to determine your actual risk level:

Network Exposure (Score: 0-3)

  • 0 points: Local network only, no internet access
  • 1 point: Local network with VPN access
  • 2 points: Exposed to internet with strong authentication
  • 3 points: Exposed to internet with weak or no authentication

User Access (Score: 0-3)

  • 0 points: Single user, you only
  • 1 point: Multiple trusted family members
  • 2 points: Guest access enabled
  • 3 points: Public or semi-public access

Integration Trust (Score: 0-3)

  • 0 points: Only official integrations
  • 1 point: Mostly official with few community integrations
  • 2 points: Mix of official and community integrations
  • 3 points: Many third-party or custom integrations

Update Status (Score: 0-3)

  • 0 points: Running latest version (2024.1.0+)
  • 1 point: Running recent version (within 2 months)
  • 2 points: Running older version (2-6 months old)
  • 3 points: Running very old version (6+ months old)

Statistics Graph Card Usage (Score: 0-3)

  • 0 points: Not using Statistics Graph Cards
  • 1 point: Using on private dashboard only
  • 2 points: Using on shared dashboard
  • 3 points: Using extensively with many entities

Total Score Interpretation:

  • 0-5: Low Risk — Standard security practices sufficient
  • 6-10: Medium Risk — Implement recommended protections
  • 11-15: High Risk — Immediate action required

Deciding Whether to Continue Using Statistics Graph Card

Continue Using If:
✅ You’ve updated to Home Assistant 2024.1.0 or later
✅ You’ve audited all entity names for suspicious content
✅ You have strong authentication enabled
✅ Your network access is restricted
✅ You monitor logs regularly
✅ You trust all integrations and users

Consider Alternatives If:
❌ You’re running an older Home Assistant version and can’t update
❌ You have many third-party integrations with unknown origins
❌ You’ve exposed Home Assistant to the internet without strong security
❌ You have multiple users with dashboard access
❌ You haven’t updated in several months

Migrate Away If:
🚫 You’ve found suspicious entities on your system
🚫 You’ve experienced any security incidents
🚫 You can’t verify the security of your integrations
🚫 You’re using Home Assistant in a critical infrastructure context

Implementation Checklist for Safe Usage

Use this checklist to ensure you’ve implemented all necessary protections:

Immediate Actions (Complete Today):

  • [ ] Check Home Assistant version
  • [ ] Update to 2024.1.0 or later if needed
  • [ ] Enable two-factor authentication
  • [ ] Review all Statistics Graph Cards on dashboards
  • [ ] Audit entity names for suspicious content
  • [ ] Review user permissions

Short-Term Actions (Complete This Week):

  • [ ] Document your entity naming convention
  • [ ] Remove any suspicious entities
  • [ ] Enable detailed logging
  • [ ] Set up security notifications
  • [ ] Review active sessions and revoke unfamiliar ones
  • [ ] Update all add-ons and integrations

Long-Term Actions (Ongoing):

  • [ ] Monitor logs weekly
  • [ ] Check for updates monthly
  • [ ] Audit permissions quarterly
  • [ ] Review security practices semi-annually
  • [ ] Keep documentation updated
  • [ ] Test backup and restore procedures

Frequently Asked Questions

What exactly is the XSS vulnerability in the Statistics Graph Card?

The Statistics Graph Card fails to properly sanitize entity names before displaying them in tooltips. This allows attackers to inject malicious JavaScript code through entity names. When you hover over the chart, the code executes in your browser, potentially compromising your Home Assistant session.

Technical Details: The vulnerability exists in how the card renders entity names in ECharts tooltips without HTML escaping. An entity name like sensor.temp<img src=x> would execute the code when the tooltip appears.

How do I know if my Home Assistant installation is vulnerable?

Check your Home Assistant version:

  1. Go to Settings → About
  2. If your version is 2023.12.x or earlier, you’re vulnerable
  3. If your version is 2024.1.0 or later, you have the patch

Additionally, if you’re using Statistics Graph Cards with entities from untrusted sources, your risk is higher.

Can this vulnerability be exploited remotely or only locally?

Both, depending on your setup:

  • Remote Exploitation: If your Home Assistant is exposed to the internet, an attacker can exploit this remotely by creating a malicious entity and getting you to view it
  • Local Exploitation: Even on a local network, an attacker with network access (or through a compromised device) can create malicious entities
  • Indirect Exploitation: An attacker could compromise an integration or add-on to inject malicious entity names

The vulnerability requires you to view a Statistics Graph Card displaying the malicious entity, but this can happen automatically if the card is on your default dashboard.

What should I do if I’ve already added Statistics Graph Cards to my dashboard?

Don’t panic. Follow these steps:

  1. Update Home Assistant to 2024.1.0 or later (this patches the vulnerability)
  2. Audit your entity names for suspicious content
  3. Review your integrations to ensure they’re trustworthy
  4. Monitor your logs for any suspicious activity
  5. Keep the cards if you trust your entities, or migrate to alternatives if you prefer

The vulnerability only affects unpatched versions, so updating is your primary protection.

Are there any workarounds if I can’t update Home Assistant immediately?

Temporary Workarounds (Not Recommended Long-Term):

  1. Remove Statistics Graph Cards: Delete all Statistics Graph Cards from your dashboards until you can update
  2. Restrict Access: Limit who can access Home Assistant and disable internet exposure
  3. Disable Untrusted Integrations: Remove any integrations you don’t fully trust
  4. Monitor Closely: Check logs frequently for suspicious entity creation
  5. Use Alternatives: Switch to the Energy Dashboard or other visualization tools

However: These are temporary measures. You should prioritize updating Home Assistant as soon as possible.

How often does Home Assistant release security patches?

Home Assistant follows a regular release schedule:

  • Major Releases: Monthly (e.g., 2024.1, 2024.2, etc.)
  • Patch Releases: As needed for critical security issues
  • Security Advisories: Published on the Home Assistant website and GitHub

Best Practice: Check for updates weekly and apply security patches immediately.

Should I remove all Statistics Graph Cards from my dashboard?

Not necessarily, but it depends on your situation:

Keep Them If:

  • You’ve updated to Home Assistant 2024.1.0 or later
  • You’ve audited all entity names
  • You trust all your integrations
  • You have strong security practices in place

Remove Them If:

  • You’re running an older Home Assistant version
  • You have untrusted integrations
  • You’ve found suspicious entities
  • You prefer to use alternatives

Compromise Option: Keep Statistics Graph Cards for trusted entities only, and migrate other visualizations to the Energy Dashboard or Grafana.

What are the safest alternatives for monitoring energy and sensor data?

Ranked by Security:

  1. Home Assistant Energy Dashboard — Purpose-built, integrated, secure
  2. Grafana — Enterprise-grade security, isolated from Home Assistant
  3. ApexCharts Card — Community-maintained, actively updated
  4. Mini Graph Card — Lightweight, minimal attack surface
  5. Statistics Graph Card (Updated) — Patched, but requires vigilance

Choose based on your needs:

  • Simple energy monitoring: Energy Dashboard
  • Advanced analytics: Grafana
  • Customizable charts: ApexCharts Card
  • Mobile-friendly: Mini Graph Card

Conclusion

The XSS vulnerability in Home Assistant’s Statistics Graph Card is serious, but it’s manageable with the right approach. The most important step is updating to Home Assistant 2024.1.0 or later—this single action eliminates the vulnerability.

Beyond the update, implement the security practices outlined in this guide:

  • Audit your entity names
  • Enable two-factor authentication
  • Monitor your logs
  • Review user permissions
  • Keep your system updated

If you’re uncomfortable with the Statistics Graph Card even after patching, the alternatives we’ve discussed (Energy Dashboard, Grafana, ApexCharts Card) provide excellent visualization options with strong security practices.

Your smart home should enhance your life without compromising your security. By taking these steps today, you ensure that your Home Assistant instance remains a trusted, secure foundation for your smart home automation.

Start with the update. Everything else follows from there.

Additional Resources

Last Updated: January 2024
Applies To: Home Assistant 2023.12.x and earlier
Status: Critical Security Advisory

← Back to Home Automation & Smart Living