CVE-2026-53454: Blueprint Studio stored Git credentials in plaintext Git credential store
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action. This issue is fixed in version 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Blueprint Studioto a version that resolves this vulnerability.Fixed in 2.5.2 - Operational
After upgrading to Blueprint Studio 2.5.2, remove any persisted plaintext Git credentials from the user running Home Assistant’s .git-credentials file (created by Git credential-store) and rotate any exposed access tokens/usernames if applicable.
Event History
Frequently Asked Questions
Who is realistically exposed to credential disclosure?
Users of Blueprint Studio versions prior to 2.5.2 who saved Git credentials are exposed. The plaintext credentials may be readable by other users or processes that have access to the filesystem context of the user running Home Assistant.
What access does an attacker need to obtain the credentials?
An attacker needs access to the relevant filesystem context, either as another user or process able to read files used by the Home Assistant-running user. No remote-only attack path is described.
Does the problem affect only the original Git action?
The issue was triggered when Git credentials were saved, because Blueprint Studio configured Git's credential.helper store. That configuration could persist and affect Git operations performed later, beyond the original Blueprint Studio action.
How can I check whether credentials may already be exposed?
Upgrade Blueprint Studio to version 2.5.2. For systems where credentials may already have been saved, review the .git-credentials file for the user running Home Assistant and treat any exposed access tokens as potentially disclosed.