CVE-2026-53457

{
  "id": "CVE-2026-53457",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T21:16:35.570",
  "lastModified": "2026-10-22T21:09:59.367",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2."
    },
    {
      "lang": "es",
      "value": "Blueprint Studio es un editor de archivos similar a VS Code para los archivos de configuración de Home Assistant. Antes de la versión 2.5.2, la ruta de ejecución de comandos de terminal sin estado heredada en custom_components/blueprint_studio/backend/terminal_manager.py aceptaba un parámetro ’cwd’ de directorio de trabajo y solo verificaba si el directorio existía, sin requerir que permaneciera dentro del directorio de configuración de Home Assistant. Un administrador que utilizaba el asistente de terminal restringido podía seleccionar un directorio existente fuera del límite de configuración previsto. Los comandos podían entonces acceder o modificar rutas del host permitidas por el contenedor de Home Assistant y los permisos del sistema de archivos, debilitando la restricción esperada del sistema de archivos del asistente. Este problema se solucionó en la versión 2.5.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "ha-china",
          "product": "blueprint-studio",
          "versions": [
            {
              "version": "< 2.5.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 5.1,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "subAvailabilityImpact": "NONE",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T19:01:48.814723Z",
          "id": "CVE-2026-53457",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh",
      "source": "[email protected]"
    }
  ]
}