CVE-2026-53455

Received Received - Intake

Command Injection in Blueprint Studio for Home Assistant

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable helper script content without validating credential values. An attacker able to set Git credentials could include newline characters or shell syntax in a username or token. When Git executed the generated credential helper, the injected shell commands ran with the operating-system privileges of Home Assistant and could access or modify Home Assistant configuration data. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53455

Affected Vendors & Products

Vendor	Product	Version / Range
blueprint_studio	blueprint_studio	2.5.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-78	The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

Blueprint Studio is a file editor for Home Assistant configuration files. Prior to version 2.5.2, it generated a shell-based Git credential helper by directly inserting Git username and token into a script without validation. Attackers could inject shell commands via newline characters or syntax in credentials, which would execute with Home Assistant's privileges when Git ran the helper.

Detection Guidance

Check if Blueprint Studio version is below 2.5.2. Inspect Git credential helper files in custom_components/blueprint_studio/backend/git_manager.py for suspicious shell commands or newline characters in usernames or tokens.

Impact Analysis

An attacker with access to set Git credentials could execute arbitrary shell commands on your system with the same privileges as Home Assistant. This could allow them to read, modify, or delete Home Assistant configuration data, potentially leading to data breaches or system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, or reputational damage if exploited.

Mitigation Strategies

Upgrade Blueprint Studio to version 2.5.2 or later. Review and sanitize Git credentials to remove any newline characters or shell syntax. Monitor Home Assistant logs for unauthorized configuration changes.

Hi! I’m here to help you understand CVE-2026-53455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70