CVE-2026-53457: Blueprint Studio terminal command working directory not bounded to config directory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in customcomponents/blueprintstudio/backend/terminalmanager.py accepted a cwd working-directory parameter and checked only whether the directory existed, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction. This issue is fixed in version 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Blueprint Studioto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Who can exploit this issue, and what limits the impact?
Administrators who can use Blueprint Studio's restricted terminal helper are exposed on versions before 2.5.2. The impact is limited by the paths accessible to the Home Assistant container and its filesystem permissions.
What does an attacker need to do to exploit it?
The legacy stateless terminal execution path accepts an existing directory as its working directory without confirming that it is within the Home Assistant configuration directory. An administrator can select an existing external directory and run commands that access or modify permitted host paths.
What is the remediation?
Upgrade Blueprint Studio to version 2.5.2, which fixes the working-directory boundary check.