EUVD-2026-61488

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53457

In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...

CVE-2026-53456 Blueprint Studio terminal SSH private key written to disk

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

CVE-2026-53455

CVE-2026-53455 is a command injection vulnerability in Blueprint Studio , a VS Code-like editor for Home Assistant configuration files. Prior to version 2.5.2 , the component custom_components/blueprint_studio/backend/git_manager.py generated a shell-based Git credential helper by interpolating t...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

EUVD-2026-61486

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453

Blueprint Studio (a Home Assistant config editor) failed to enforce its admin-only authorization boundary prior to v2.5.2, allowing any authenticated non-admin user to invoke arbitrary services, modify config files, expose state, upload files, and reach terminal helpers, compromising CIA of the i...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

EUVD-2026-61483

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53458 Blueprint Studio API exposed internal exception details

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53458

Blueprint Studio (a Home Assistant configuration editor add-on) prior to v2.5.2 returned raw exception strings from backend API handlers in custom_components/blueprint_studio/backend/api.py to authenticated users, exposing internal filesystem paths and implementation details that could aid finger...

CVE-2026-45129 MyBB: ACP Recovery Codes CSRF

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-53456: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...