CVE-2026-53455: Blueprint Studio Git credential helper command injection
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in customcomponents/blueprintstudio/backend/gitmanager.py by interpolating the configured Git username and token directly into executable helper script content without validating credential values. An attacker able to set Git credentials could include newline characters or shell syntax in a username or token. When Git executed the generated credential helper, the injected shell commands ran with the operating-system privileges of Home Assistant and could access or modify Home Assistant configuration data. This issue is fixed in version 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Blueprint Studio Git credential helper (custom_components/blueprint_studio/backend/git_manager.py)to a version that resolves this vulnerability.Fixed in 2.5.2 - Operational
After upgrading to Blueprint Studio 2.5.2, review and rotate any Git credentials (username/token) that may have been set with injected content, since the injected shell commands could have run with Home Assistant OS privileges.
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Systems running Blueprint Studio before version 2.5.2 are affected if an attacker can set the Git username or token used by the component. Exploitation occurs when Git executes the generated credential helper.
What access does an attacker need?
The attacker needs the ability to supply or modify configured Git credential values. Crafted usernames or tokens containing newline characters or shell syntax can inject commands into the generated helper script.
What is the remediation?
Upgrade Blueprint Studio to version 2.5.2, which fixes the unsafe credential interpolation. The provided information does not describe an alternative mitigation for systems that cannot yet be upgraded.
What is the impact if exploitation succeeds?
Successful exploitation runs injected commands with the operating-system privileges of Home Assistant. Those commands can access or modify Home Assistant configuration data.