An authenticated user can store a malicious name in a device entity, causing a stored cross‑site scripting condition on any dashboard using a Map‑card that displays that entity. The script runs when a viewer hovers over the information point, potentially executing arbitrary code in the victim’s browser and exposing confidential information or hijacking the session. This is a classic stored XSS flaw classified as CWE‑79.

Home Assistant core is affected for all releases from 2020.02 up to, but not including, 2026.01. Versions 2026.01 and later contain the fix and are not vulnerable.

The CVSS score of 7.3 indicates high severity. The EPSS score of less than 1% implies a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have credentials to create or modify a device name and a victim who views a Map‑card with that device, indicating that the attack vector is authenticated followed by victim interaction (“hovers over an information point”).