CVE-2026-53458: Blueprint Studio API exposed internal exception details
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in customcomponents/blueprintstudio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
custom_components/blueprint_studioto a version that resolves this vulnerability.Fixed in 2.5.2
Event History
Frequently Asked Questions
Who is exposed to the information disclosure?
Authenticated Home Assistant users who can invoke Blueprint Studio backend API handlers may receive raw exception messages. Those messages can expose internal filesystem paths or implementation details that help fingerprint the installation.
What does an attacker need to exploit this issue?
An attacker needs valid Home Assistant authentication and must trigger an exception through a Blueprint Studio backend API handler. The issue is an information disclosure; the available data does not indicate unauthenticated exposure.
What should be done if immediate patching is not possible?
Upgrade Blueprint Studio to version 2.5.2, which fixes the raw exception disclosure. If an upgrade cannot happen immediately, limit access to authenticated Home Assistant users who need Blueprint Studio functionality.