CVE-2026-40602

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.

CVSS v3 5.6 MEDIUM

5.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/home-assistant-ecosystem/home-assistant-cli/pull/453	Issue Tracking
https://github.com/home-assistant-ecosystem/home-assistant-cli/security/advisories/GHSA-33qf-q99x-wpm8	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:home-assistant-ecosystem:home_assistant_command-line_interface:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) La interfaz de línea de comandos de Home Assistant (hass-cli) es una herramienta de línea de comandos para Home Assistant. Hasta la versión 1.0.0 de home-assistant-cli, se utilizaba un entorno sin restricciones para manejar plantillas Jinja2 en lugar de uno aislado. La entrada proporcionada por el usuario dentro de las plantillas Jinja2 se renderizaba localmente sin restricciones. Esto daba a los usuarios acceso a los componentes internos de Python y extendía el alcance de la creación de plantillas más allá del uso previsto. Esta vulnerabilidad está corregida en la versión 1.0.0.

Information

Published : 2026-04-21 18:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-40602

Mitre link : CVE-2026-40602

CVE.ORG link : CVE-2026-40602

JSON object : View

Products Affected

home-assistant-ecosystem

home_assistant_command-line_interface

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-1336

Improper Neutralization of Special Elements Used in a Template Engine

{"id": "CVE-2026-40602", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-40602", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-21T19:01:54.397388Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.6, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "home-assistant-ecosystem", "product": "home-assistant-cli", "versions": [{"status": "affected", "version": "< 1.0.0"}]}]}], "published": "2026-04-21T18:16:51.827", "references": [{"url": "https://github.com/home-assistant-ecosystem/home-assistant-cli/pull/453", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/home-assistant-ecosystem/home-assistant-cli/security/advisories/GHSA-33qf-q99x-wpm8", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-1336"}]}], "descriptions": [{"lang": "en", "value": "The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0."}, {"lang": "es", "value": "La interfaz de l\u00ednea de comandos de Home Assistant (hass-cli) es una herramienta de l\u00ednea de comandos para Home Assistant. Hasta la versi\u00f3n 1.0.0 de home-assistant-cli, se utilizaba un entorno sin restricciones para manejar plantillas Jinja2 en lugar de uno aislado. La entrada proporcionada por el usuario dentro de las plantillas Jinja2 se renderizaba localmente sin restricciones. Esto daba a los usuarios acceso a los componentes internos de Python y extend\u00eda el alcance de la creaci\u00f3n de plantillas m\u00e1s all\u00e1 del uso previsto. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.0.0."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:home-assistant-ecosystem:home_assistant_command-line_interface:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "07740846-6543-4428-9054-ED1EDD1B003E", "versionEndExcluding": "1.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}