Description

Currenty, adding a "+ to the password, or a DOM element to the title, you can inject scripts into HA. I know that this library is meant to be not-secure by design, as stated in the README, and that if someone can update the Lovelance dashboard he can probably execute JS code in other ways, but I think that we can easily fix this.

Proof of Concept

// PoC title
// Scripts in title will be executed on card load
title: 'Title<img hidden src=x onerror="alert(document.location.href)"></img>'

// PoC password
// Scripts in password will be executed after password submittion
password: '"+alert(document.location.href)+"'

Impact

A user that can edit Lovelance configuration can inject JS scripts for every user.