A stored cross‑site scripting flaw exists in the history‑graphs that display the remaining charge time sensor for mobile phones. By injecting malicious JavaScript into that sensor, an attacker can cause the script to execute whenever any user opens the affected chart. This can result in theft of session cookies, unauthorized actions performed with the user’s credentials, or manipulation of the web interface. The vulnerability is an input validation failure that stores and later executes malicious code.

The problem affects Home Assistant core. Versions beginning with 2025.02 through any release before 2026.01 contain the flaw, while version 2026.01 and later have fixed the issue by sanitizing the input. No other components or integrations are listed as vulnerable.

The CVSS score of 7.3 indicates a high risk potential. The EPSS score is less than 1%, suggesting a low probability of exploitation at present. The flaw is not catalogued as a known exploited vulnerability. It is inferred that the attack vector would involve supplying the malicious data through the web interface, likely by authenticating or compromising a user session, which would then lead to script execution for anyone who views the history graph.