CVE-2026-53457: Blueprint Studio Path Traversal Flaw

CVE-2026-53457 Overview

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. CVE-2026-53457 is a path traversal vulnerability [CWE-22] in the legacy stateless terminal command execution path located in custom_components/blueprint_studio/backend/terminal_manager.py. The code accepts a cwd working-directory parameter and only checks whether the directory exists. It does not require the directory to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper can select an existing directory outside the intended boundary. Commands can then access or modify host paths permitted by the Home Assistant container and filesystem permissions. The issue is fixed in version 2.5.2.

Critical Impact
Authenticated administrators can escape the intended configuration directory boundary and execute commands against arbitrary filesystem paths reachable by the Home Assistant process.

Affected Products

Blueprint Studio (ha-china/blueprint-studio) versions prior to 2.5.2
Home Assistant deployments running the Blueprint Studio custom component
Installations exposing the restricted terminal helper to admin users

Discovery Timeline

2026-08-18 - CVE-2026-53457 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-53457

Vulnerability Analysis

Blueprint Studio ships a restricted terminal helper intended to constrain shell activity to the Home Assistant configuration directory. The legacy stateless execution path in terminal_manager.py accepts a caller-supplied cwd parameter to set the working directory for command execution. The validation logic checks only that the supplied path exists on disk. It does not verify that the path is a descendant of the configuration root.

An administrator interacting with the helper can supply any existing directory on the container filesystem. The subprocess then runs with that directory as its working context. Commands issued through the helper inherit the container's filesystem permissions and can read or modify paths outside the intended configuration boundary. This weakens the helper's advertised sandboxing model even though the caller is already privileged.

Root Cause

The root cause is missing containment validation on user-controlled path input. Existence checks (os.path.isdir or equivalent) do not enforce a parent-directory relationship. Without a canonicalized comparison against the configuration root, ../ traversal or absolute paths pointing outside the config directory pass validation. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires administrator privileges on the Home Assistant instance. Once authenticated, the actor invokes the terminal helper with a cwd value pointing outside the configuration directory. The resulting subprocess executes with that working directory, granting read and write access to any host path the Home Assistant container can reach.

python

# Patch excerpt from custom_components/blueprint_studio/backend/api.py
# Source: https://github.com/ha-china/blueprint-studio/commit/943aed0be67f3a910b0f70a3864288d5e17e55ce

_LOGGER = logging.getLogger(__name__)

# Blueprint Studio is registered as an admin-only panel and exposes config files,
# git operations, SFTP, terminal helpers, and HA service calls. Keep the backend
# at the same privilege level as the UI instead of trying to maintain a denylist.
_ADMIN_ONLY_ACTIONS = frozenset({
    "call_service",
    "delete",
    "delete_multi",
    "global_replace",
    "git_force_push",
    "git_hard_reset",
    "git_delete_repo",
    "git_delete_remote_branch",
    "render_template",
    "restart_home_assistant",
})

The upstream patch also hardens git_manager.py by introducing tempfile for isolated credential handling. See the GitHub Security Advisory GHSA-5cc6-r4rr-fpfh for the full advisory.

Detection Methods for CVE-2026-53457

Indicators of Compromise

Terminal helper invocations with cwd values pointing outside the Home Assistant configuration directory (e.g., /, /etc, /usr, /data).
Subprocess activity from the Blueprint Studio backend accessing paths unrelated to configuration files or automations.
Unexpected reads or writes under container-mounted host directories originating from the Home Assistant process tree.

Detection Strategies

Audit Blueprint Studio backend logs for terminal_manager.py command executions and inspect the cwd parameter for out-of-boundary paths.
Correlate Home Assistant admin session activity with filesystem events on paths outside /config.
Alert on any child process of Home Assistant executing shell commands with working directories that are not descendants of the configuration root.

Monitoring Recommendations

Enable filesystem auditing (auditd, eBPF) on Home Assistant hosts to record process working directories and file access outside /config.
Track version metadata of the Blueprint Studio custom component across deployments to identify installations still below 2.5.2.
Monitor administrative account activity on Home Assistant for anomalous terminal helper usage patterns.

How to Mitigate CVE-2026-53457

Immediate Actions Required

Upgrade Blueprint Studio to version 2.5.2 or later using the GitHub Release v2.5.2.
Review Home Assistant administrator accounts and revoke privileges for any accounts that no longer require them.
Inspect recent terminal helper activity for cwd values outside the configuration directory.

Patch Information

The fix is included in Blueprint Studio 2.5.2. The security commit hardens the terminal helper, secures Git credential handling, and aligns backend action authorization with the admin-only panel model by expanding _ADMIN_ONLY_ACTIONS.

Workarounds

Restrict access to the Blueprint Studio admin panel to a minimal set of trusted administrators until the upgrade is applied.
Disable the legacy stateless terminal helper if the deployment does not require it.
Run Home Assistant with tightened container filesystem mounts so sensitive host paths are not reachable from the container.