CVE-2026-53455

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable helper script content without validating credential values. An attacker able to set Git credentials could include newline characters or shell syntax in a username or token. When Git executed the generated credential helper, the injected shell commands ran with the operating-system privileges of Home Assistant and could access or modify Home Assistant configuration data. This issue is fixed in version 2.5.2.

• CWE-78

• https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce
• https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2
• https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-wjpc-mc3f-w5rg

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53449Coturn is a free open source implementation of TURN and STUN…6
• CVE-2026-53450Coturn is a free open source implementation of TURN and STUN…7.4
• CVE-2026-53451Ground Station is a browser-based suite for satellite tracki…9.8
• CVE-2026-53452Ground Station is a browser-based suite for satellite tracki…5.3
• CVE-2026-53453Blueprint Studio is a VS Code-like file editor for Home Assi…8.7
• CVE-2026-53454Blueprint Studio is a VS Code-like file editor for Home Assi…6.9
• CVE-2026-53456Blueprint Studio is a VS Code-like file editor for Home Assi…5.6
• CVE-2026-53457Blueprint Studio is a VS Code-like file editor for Home Assi…5.1
• CVE-2026-53458Blueprint Studio is a VS Code-like file editor for Home Assi…5.3
• CVE-2026-53459Bambuddy is a self-hosted print archive and management syste…9.3
• CVE-2026-5346A vulnerability was determined in huimeicloud hm_editor up t…7.3
• CVE-2026-53460ImageMagick is free and open-source software used for editin…7.5