CVE-2026-53454

Received Received - Intake

Blueprint Studio Plaintext Credential Storage Vulnerability

Publication date: 2026-08-18

Last updated on: 2026-08-21

Assigner: GitHub, Inc.

Description

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-21

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53454

Affected Vendors & Products

Vendor	Product	Version / Range
blueprint_studio	blueprint_studio	2.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-522	The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

Executive Summary

Blueprint Studio is a file editor for Home Assistant configuration files. Prior to version 2.5.2, it stored Git credentials in plaintext in the .git-credentials file due to improper Git credential.helper configuration. This allowed other users or processes with filesystem access to read sensitive tokens.

Detection Guidance

Check for plaintext credentials in the .git-credentials file in the user's home directory or Home Assistant configuration folder. Use commands like 'cat ~/.git-credentials' or 'find ~ -name .git-credentials -exec cat {} \;' to inspect for stored Git credentials.

Impact Analysis

Attackers with filesystem access could steal stored Git credentials, including usernames and access tokens. This may lead to unauthorized access to repositories or other systems using the same credentials. Persistent Git helper configuration could also expose tokens in future Git operations.

Compliance Impact

This vulnerability may violate compliance requirements that mandate protection of sensitive data like credentials. Exposure of plaintext tokens could lead to unauthorized data access, potentially breaching GDPR or HIPAA if such tokens grant access to regulated data.

Mitigation Strategies

Upgrade Blueprint Studio to version 2.5.2 or later. Remove any plaintext credentials from the .git-credentials file and revoke exposed access tokens. Disable Git's credential.helper if not needed with 'git config --global --unset credential.helper'.

Hi! I’m here to help you understand CVE-2026-53454. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70