Home Assistant HACS - Local File Inclusion

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration. id: CVE-2021-3152 info: name: Home Assistant HACS - Local File Inclusion...

frigate

Frigate NVR™ - Rilevamento oggetti in tempo reale per telecamere IP Inglese | 简体中文 Un NVR completo e locale progettato per Home Assistant con rilevamento degli oggetti tramite AI. Utilizza OpenCV e TensorFlow per eseguire il rilevamento di oggetti in tempo reale localmente per telecamere IP. L'us...

CVE-2023-41898_Lab

CVE-2023-41898 Unvalidated Deep Link Lab È un Lab educativo di riproduzione ridotta basato sul report di vulnerabilità pubblico GHSL-2023-142 di Home Assistant Companion for Android e sulla struttura open source della versione vulnerabile 2023.8.2. Non utilizza server, account o token reali di Ho...

CVE-2026-64824-PoC

CVE-2026-64824 — Traversal de Caminho via Symlink no Backup-Restore do Home Assistant Core → RCE CVSS 8.4 Crítico · GHSA-cwh8-w64c-4j5h · CWE-22 / CWE-59 TL;DR Um atacante autenticado admin envia um tar de backup malicioso. O caminho de restauração extrai o homeassistant.tar.gz interno com...

publications

Pubblicazioni Uno spazio per le pubblicazioni, inclusi slide/documenti, proof-of-concept, video e strumenti. Per i post del blog, vedi il blog elttam, e per i nostri servizi, vedi il nostro sito web. Data| Tipo| Evento| Titolo| Risorse ---|---|---|---|--- 2026| adv| -| Home Assistant: lettura...

NoLongerEvil-Thermostat

Configurazione Firmware Nest Thermostat 🏆 Vincitore del FULU Bounty 🏆 Hack House e questo progetto sono i vincitori ufficiali del FULU Bounty per Nest Learning Thermostat Gen 1/2 Alternativa Hardware: Se sei interessato al lato hardware, dai un'occhiata a https://sett.homes per un'opzione di...

espectre

🛜 ESPectre 👻 Bewegungserkennungssystem basierend auf Wi-Fi-Spektrumanalyse CSI, mit nativer Home-Assistant-Integration über ESPHome. !TIP Neuer ML-Detektor : Bewegungserkennung auf Basis neuronaler Netze. Keine Kalibrierung erforderlich, läuft auf dem Gerät. Dies ist eine experimentelle Funktion;...

gha-lab-7ccf56a2a4

HomeAssistant - Tapo: Cameras Control Componente personalizzato - Tapo: Cameras Control - per aggiungere telecamere Tapo, campanelli e suonerie a Home Assistant ⭐ Ora espone anche uno stream per i dispositivi che non hanno funzionalità RTSP o ONVIF. Installazione Copia il contenuto di...

CVE-2026-53455

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53456

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

EUVD-2026-61488

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53457

In Blueprint Studio before 2.5.2, the legacy terminal path in terminal_manager.py accepted a cwd parameter and only checked directory existence, allowing an admin to run commands in directories outside the Home Assistant config boundary, weakening filesystem restrictions. Fixed in version 2.5.2. ...

CVE-2026-53455

CVE-2026-53455 is a command injection vulnerability in Blueprint Studio , a VS Code-like editor for Home Assistant configuration files. Prior to version 2.5.2 , the component custom_components/blueprint_studio/backend/git_manager.py generated a shell-based Git credential helper by interpolating t...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53455 Blueprint Studio Git credential helper command injection

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53454 Blueprint Studio stored Git credentials in plaintext Git credential store

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453 Blueprint Studio API authorization bypass for non-admin Home Assistant users

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53453

Blueprint Studio (a Home Assistant config editor) failed to enforce its admin-only authorization boundary prior to v2.5.2, allowing any authenticated non-admin user to invoke arbitrary services, modify config files, expose state, upload files, and reach terminal helpers, compromising CIA of the i...