CVE-2026-53458

Received Received - Intake

Blueprint Studio Information Disclosure via Raw Exception Messages

Publication date: 2026-08-18

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-19

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-53458

Affected Vendors & Products

Vendor	Product	Version / Range
blueprint_studio	blueprint_studio	to 2.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

Executive Summary

Blueprint Studio is a file editor for Home Assistant configuration files. Before version 2.5.2, its backend API exposed raw exception messages to authenticated users. These messages sometimes included internal filesystem paths or implementation details, which could help attackers identify system specifics for further attacks.

Detection Guidance

Check if Blueprint Studio version is below 2.5.2 by inspecting the Home Assistant add-on or custom component files. Look for exposed exception messages in API responses that may reveal filesystem paths or implementation details.

Impact Analysis

If you use Blueprint Studio versions before 2.5.2, an authenticated attacker could gain information about your Home Assistant setup. This includes filesystem paths or system details, which may assist in planning more targeted attacks against your environment.

Compliance Impact

The vulnerability exposes internal filesystem paths or implementation details to authenticated users, which could aid in fingerprinting Home Assistant installations. This may indirectly impact compliance by increasing attack surface, but direct effects on standards like GDPR or HIPAA are not specified in the provided context.

Mitigation Strategies

Update Blueprint Studio to version 2.5.2 or later. Review API logs for sensitive information leaks and restrict access to authenticated users only.

Hi! I’m here to help you understand CVE-2026-53458. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70