CVE-2026-53458: falha de média gravidade em ha-china blueprint-studio
Blueprint Studio API exposed internal exception details
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Produtos afetados
ha-china · blueprint-studioCVEs relacionadas — ha-china blueprint-studio
No mesmo produto, das mais perigosas para as menos.
CVE-2026-53457MEDIUMBlueprint Studio terminal command working directory not bounded to config directoryEPSS 0.8%CVE-2026-53455HIGHBlueprint Studio Git credential helper command injectionEPSS 0.5%CVE-2026-53454MEDIUMBlueprint Studio stored Git credentials in plaintext Git credential storeEPSS 0.5%CVE-2026-53453HIGHBlueprint Studio API authorization bypass for non-admin Home Assistant usersEPSS 0.4%CVE-2026-53456MEDIUMBlueprint Studio terminal SSH private key written to diskEPSS 0.2%