CVE-2026-53458

Blueprint Studio (a Home Assistant configuration editor add-on) prior to v2.5.2 returned raw exception strings from backend API handlers in custom_components/blueprint_studio/backend/api.py to authenticated users, exposing internal filesystem paths and implementation details that could aid finger...

CVE-2026-53458 Blueprint Studio API exposed internal exception details

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

ANT-2026-66X46XSC · supabase/supabase · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-66X46XSC: X-Content-Type-Options header set to invalid value The Next.js headers configuration for the Supabase...

ANT-2026-EFRBDRNP · supabase/supabase · open-redirect

open-redirect low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-EFRBDRNP: Unvalidated returnTo redirect after organisation creation In Supabase Studio's NewOrgForm...

ANT-2026-AM0R21ZY · supabase/supabase · broken-access-control

broken-access-control medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-AM0R21ZY: HIPAA sensitive-project AI block enforced only client-side The client hook...

ANT-2026-SXD0NN2P · supabase/supabase · SQL Injection

sql-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-SXD0NN2P: Link-driven SQL injection via table-editor filter ARRAY bypass The Supabase Studio Table Editor...

ANT-2026-MEXHXGNE · supabase/supabase · SQL Injection

sql-injection high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-MEXHXGNE: Link-driven SQL injection via schema URL parameter Supabase Studio reads the ?schema= URL...

EUVD-2026-60553

Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensitive information via the validatePath function in api/hermes/download endpoint...

CVE-2026-53453: Missing Authorization

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization...

CVE-2026-53456: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in customcomponents/blueprintstudio/backend/terminalmanager.py wrote SSH private-key material to a file under the Home Assistant configuration...

CVE-2026-53454: Insufficiently Protected Credentials

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials fi...

CVE-2026-53458: Generation of Error Message Containing Sensitive Information

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could conta...

CVE-2026-53457: Improper Limitation of a Pathname to a Restricted Directory

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the...

CVE-2026-53455: Improper Neutralization of Special Elements used in an OS Command

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into...

PT-2026-77315

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio generates a shell-based Git credential helper in the custom components/blueprint studio/backend/git manager.py file by interpolating the configured Git username and token...

PT-2026-77317

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepted a cwd working-directory parameter and checked only whether the...

PT-2026-77316

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom components/blueprint studio/backend/terminal manager.py wrote SSH private-key material to a file under the Home Assistant configuration...

PT-2026-77318

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Backend API handlers in custom components/blueprint studio/backend/api.py return raw exception strings to authenticated Home Assistant users. These exception messages may disclose internal...

PT-2026-77314

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio improperly configures the Git credential.helper store when saving credentials. This causes the system to persist usernames and access tokens in plaintext within the...

PT-2026-77313

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio fails to consistently enforce the admin-only authorization boundary on its backend, allowing any authenticated Home Assistant user to access actions intended for...