CVE-2026-53455

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454

Prior to version 2.5.2, Blueprint Studio configured Git's credential.helper store, writing usernames and access tokens in plaintext to a .git-credentials file accessible to other users/processes on the same filesystem, exposing Home Assistant Git credentials; the issue is fixed in 2.5.2. No explo...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

EUVD-2026-61485

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

PT-2026-77315

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom components/blueprint studio/backend/git manager.py by interpolating the configured Git username and token directly into...

EUVD-2026-60256

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log...

GO-2025-4013 vulnerabilities

Vulnerabilities for packages: sealed-secrets, prometheus-node-exporter, step-kms-plugin, influxd, prometheus, longhorn-instance-manager, php-fpmexporter, dask-gateway, tekton-pipelines-fips, aws-s3-controller, trivy-operator-fips, gatekeeper, hello-world-golang, protoc-gen-go, opentofu, istio,...

GO-2025-4009 vulnerabilities

Vulnerabilities for packages: sealed-secrets, prometheus-node-exporter, step-kms-plugin, influxd, prometheus, longhorn-instance-manager, php-fpmexporter, dask-gateway, tekton-pipelines-fips, aws-s3-controller, trivy-operator-fips, gatekeeper, hello-world-golang, protoc-gen-go, opentofu, istio,...

SleeperGem Uses Three Malicious RubyGems Packages to Target Developer Machines

Cybersecurity researchers have flagged a new software supply chain attack codenamed SleeperGem targeting the Ruby ecosystem after three malicious gems were published to RubyGems with the end goal of serving additional payloads. The rogue gems are listed below - gitcredentialmanager versions 2.8.0...

Medium: amazon-ssm-agent

Issue Overview: go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0...

Ubuntu 16.04 LTS / 18.04 LTS : Git vulnerabilities (USN-7964-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7964-1 advisory. It was discovered that Git did not properly sanitize URLs when asking for credentials via a terminal prompt. An attacker could possibly use...

USN-7964-1 git vulnerabilities

It was discovered that Git did not properly sanitize URLs when asking for credentials via a terminal prompt. An attacker could possibly use this issue to trick a user into disclosing their password. CVE-2024-50349 It was discovered that Git did not properly handle carriage return characters in it...

GHSA-FRHW-MQJ2-WXW2 vulnerabilities

Vulnerabilities for packages: src-fingerprint, maru, sriov-network-device-plugin, gitleaks, timescaledb-parallel-copy, terraform-docs, sealed-secrets, terraform-provider-time, chartmuseum, nuclei, istio, cluster-api-helm-controller, petname, ytt, azure-workload-identity-webhook, kwok, envconsul,...

GHSA-WCW9-47FP-RRFR vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, rancher-machine, fq, secrets-store-csi-driver-provider-gcp, go-md2man, crossplane, maru, src-fingerprint, pulumi-kubernetes-operator, infinispan-operator, iptables-wrappers, renovate, amass, go-bindata, kube-state-metrics, nsc,...

CVE-2025-61723 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, rancher-machine, fq, secrets-store-csi-driver-provider-gcp, go-md2man, crossplane, maru, src-fingerprint, pulumi-kubernetes-operator, shfmt, infinispan-operator, iptables-wrappers, renovate, velero-plugin-for-csi, amass, go-bindata,...

GHSA-9GCR-GP5F-JW27 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, rancher-machine, fq, src-fingerprint, go-md2man, crossplane, maru, pulumi-kubernetes-operator, shfmt, infinispan-operator, iptables-wrappers, renovate, velero-plugin-for-csi, amass, go-bindata, kube-state-metrics, nsc,...

GHSA-CXQ7-XW9V-RCV3 vulnerabilities

Vulnerabilities for packages: velero-plugin-for-aws, rancher-machine, fq, secrets-store-csi-driver-provider-gcp, go-md2man, crossplane, maru, src-fingerprint, pulumi-kubernetes-operator, shfmt, infinispan-operator, iptables-wrappers, renovate, velero-plugin-for-csi, amass, go-bindata,...