CVE-2026-53457

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53457", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-06-09T16:31:21.495Z", "datePublished": "2026-08-18T20:51:01.913Z", "dateUpdated": "2026-08-19T19:01:58.141Z"}, "containers": {"cna": {"title": "Blueprint Studio terminal command working directory not bounded to config directory", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.1, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh"}, {"name": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce", "tags": ["x_refsource_MISC"], "url": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce"}, {"name": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2"}], "affected": [{"vendor": "ha-china", "product": "blueprint-studio", "versions": [{"version": "< 2.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T20:51:01.913Z"}, "descriptions": [{"lang": "en", "value": "Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2."}], "source": {"advisory": "GHSA-5cc6-r4rr-fpfh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T19:01:48.814723Z", "id": "CVE-2026-53457", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:01:58.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53457", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T19:01:48.814723Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T19:01:53.930Z"}}], "cna": {"title": "Blueprint Studio terminal command working directory not bounded to config directory", "source": {"advisory": "GHSA-5cc6-r4rr-fpfh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "ha-china", "product": "blueprint-studio", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "references": [{"url": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh", "name": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce", "name": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2", "name": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T20:51:01.913Z"}}}, "cveMetadata": {"cveId": "CVE-2026-53457", "state": "PUBLISHED", "dateUpdated": "2026-08-19T19:01:58.141Z", "dateReserved": "2026-06-09T16:31:21.495Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T20:51:01.913Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "blueprint-studio", "vendor": "ha-china", "versions": [{"status": "affected", "version": "< 2.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2."}, {"lang": "es", "value": "Blueprint Studio es un editor de archivos similar a VS Code para los archivos de configuraci\u00f3n de Home Assistant. Antes de la versi\u00f3n 2.5.2, la ruta de ejecuci\u00f3n de comandos de terminal sin estado heredada en custom_components/blueprint_studio/backend/terminal_manager.py aceptaba un par\u00e1metro \u2019cwd\u2019 de directorio de trabajo y solo verificaba si el directorio exist\u00eda, sin requerir que permaneciera dentro del directorio de configuraci\u00f3n de Home Assistant. Un administrador que utilizaba el asistente de terminal restringido pod\u00eda seleccionar un directorio existente fuera del l\u00edmite de configuraci\u00f3n previsto. Los comandos pod\u00edan entonces acceder o modificar rutas del host permitidas por el contenedor de Home Assistant y los permisos del sistema de archivos, debilitando la restricci\u00f3n esperada del sistema de archivos del asistente. Este problema se solucion\u00f3 en la versi\u00f3n 2.5.2."}], "id": "CVE-2026-53457", "lastModified": "2026-10-22T21:09:59.367", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53457", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T19:01:48.814723Z", "version": "2.0.3"}}]}, "published": "2026-08-18T21:16:35.570", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce"}, {"source": "security-advisories@github.com", "url": "https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "blueprint-studio", "source": "cna", "vendor": "ha-china"}, "product": "blueprint-studio", "vendor": "ha-china"}], "created": "2026-08-21T12:32:29.953538+00:00", "updated": "2026-08-21T17:00:04.116091+00:00", "vendors": ["ha-china", "ha-china$PRODUCT$blueprint-studio"]}