CVE-2026-53457

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2.

CVSS

No CVSS.

References

Link	Resource
https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce
https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2
https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh

Configurations

No configuration.

History

22 Oct 2026, 21:09

Type	Values Removed	Values Added
Summary		(es) Blueprint Studio es un editor de archivos similar a VS Code para los archivos de configuración de Home Assistant. Antes de la versión 2.5.2, la ruta de ejecución de comandos de terminal sin estado heredada en custom_components/blueprint_studio/backend/terminal_manager.py aceptaba un parámetro ’cwd’ de directorio de trabajo y solo verificaba si el directorio existía, sin requerir que permaneciera dentro del directorio de configuración de Home Assistant. Un administrador que utilizaba el asistente de terminal restringido podía seleccionar un directorio existente fuera del límite de configuración previsto. Los comandos podían entonces acceder o modificar rutas del host permitidas por el contenedor de Home Assistant y los permisos del sistema de archivos, debilitando la restricción esperada del sistema de archivos del asistente. Este problema se solucionó en la versión 2.5.2.

Information

Published : 2026-08-18 21:16

Updated : 2026-10-22 21:09

NVD link : CVE-2026-53457

Mitre link : CVE-2026-53457

CVE.ORG link : CVE-2026-53457

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2026-53457", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53457", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:01:48.814723Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ha-china", "product": "blueprint-studio", "versions": [{"status": "affected", "version": "< 2.5.2"}]}]}], "published": "2026-08-18T21:16:35.570", "references": [{"url": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce", "source": "security-advisories@github.com"}, {"url": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2", "source": "security-advisories@github.com"}, {"url": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2."}, {"lang": "es", "value": "Blueprint Studio es un editor de archivos similar a VS Code para los archivos de configuraci\u00f3n de Home Assistant. Antes de la versi\u00f3n 2.5.2, la ruta de ejecuci\u00f3n de comandos de terminal sin estado heredada en custom_components/blueprint_studio/backend/terminal_manager.py aceptaba un par\u00e1metro \u2019cwd\u2019 de directorio de trabajo y solo verificaba si el directorio exist\u00eda, sin requerir que permaneciera dentro del directorio de configuraci\u00f3n de Home Assistant. Un administrador que utilizaba el asistente de terminal restringido pod\u00eda seleccionar un directorio existente fuera del l\u00edmite de configuraci\u00f3n previsto. Los comandos pod\u00edan entonces acceder o modificar rutas del host permitidas por el contenedor de Home Assistant y los permisos del sistema de archivos, debilitando la restricci\u00f3n esperada del sistema de archivos del asistente. Este problema se solucion\u00f3 en la versi\u00f3n 2.5.2."}], "lastModified": "2026-10-22T21:09:59.367", "sourceIdentifier": "security-advisories@github.com"}