CVE-2026-53457

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2.

• CWE-22

• https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce
• https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2
• https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-5cc6-r4rr-fpfh

Published

Aug 18, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-53451Ground Station is a browser-based suite for satellite tracki…9.8
• CVE-2026-53452Ground Station is a browser-based suite for satellite tracki…5.3
• CVE-2026-53453Blueprint Studio is a VS Code-like file editor for Home Assi…8.7
• CVE-2026-53454Blueprint Studio is a VS Code-like file editor for Home Assi…6.9
• CVE-2026-53455Blueprint Studio is a VS Code-like file editor for Home Assi…8.6
• CVE-2026-53456Blueprint Studio is a VS Code-like file editor for Home Assi…5.6
• CVE-2026-53458Blueprint Studio is a VS Code-like file editor for Home Assi…5.3
• CVE-2026-53459Bambuddy is a self-hosted print archive and management syste…9.3
• CVE-2026-5346A vulnerability was determined in huimeicloud hm_editor up t…7.3
• CVE-2026-53460ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-53461ImageMagick is free and open-source software used for editin…7.5
• CVE-2026-53462ImageMagick is free and open-source software used for editin…5.9