CVE-2026-53458

What it is

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account. Limited direct impact.

Exploit odds

0.5% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-08-18 21:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-22 21:09 UTC Last updatedMost recent change to the record

Details

Published

2026-08-18 21:16 UTC

Last modified

2026-10-22 21:09 UTC

Exploit probability

0.5% · EPSS, next 30 days

Weakness

CWE-209

Record status

Deferred

Attack profile CVSS 4.0 · 5.3

Attack vector

Network

Complexity

Low

Attack requirements

None

Privileges needed

Low

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None