CVE-2026-53455: Improper Neutralization of Special Elements used in an OS Command

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-75827: Improper Control of Generation of Code

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can invoke the errorlog function through a data directive ...

PT-2026-76937

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.14 Description An issue exists where the access field in the core group blueprint is not properly guarded by the security@: admin.super restriction. This allows a delegated admin.users operator to escalate their...

PT-2026-77318

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Backend API handlers in custom components/blueprint studio/backend/api.py return raw exception strings to authenticated Home Assistant users. These exception messages may disclose internal...

PT-2026-77313

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio fails to consistently enforce the admin-only authorization boundary on its backend, allowing any authenticated Home Assistant user to access actions intended for...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...

PT-2026-77316

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom components/blueprint studio/backend/terminal manager.py wrote SSH private-key material to a file under the Home Assistant configuration...

CVE-2026-53458: Generation of Error Message Containing Sensitive Information

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53453: Missing Authorization

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53456: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

CVE-2026-53457: Improper Limitation of a Pathname to a Restricted Directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

PT-2026-77314

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio improperly configures the Git credential.helper store when saving credentials. This causes the system to persist usernames and access tokens in plaintext within the...

PT-2026-77315

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio generates a shell-based Git credential helper in the custom components/blueprint studio/backend/git manager.py file by interpolating the configured Git username and token...

SRH_XSS_Finder

SRHXSSFinder - Deployment Guide for Render Authorized XSS A...

Grav CMS isSafeDynamicCall File Access

The vulnerability of the Blueprint::isSafeDynamicCall method in the Grav CMS system is related to improper code generation management. Exploiting this vulnerability can allow an attacker to gain unauthorized access to read, create, and copy files and directories...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Blueprint::isSafeDynamicCall process. An attacker can execute arbitrary public static PHP methods with...

CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

CVE-2026-69088 Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...

CVE-2026-69088

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls Class::method in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall only applies its dangerous-callable denylist to strings that do not contain '::'. An account with only page-editing...