CVE-2026-53458
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Blueprint Studio before version 2.5.2 returns raw exception strings in API responses to authenticated Home Assistant users. Some exception messages may contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks.
Risk Assessment
Disclosure of internal paths and implementation details may facilitate more targeted attacks on the system.
Recommendation
Upgrade Blueprint Studio to version 2.5.2 or later, which includes the fix.
Original NVD description (English source)
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.