CyberRota Analysis
AI-GeneratedBlueprint Studio prior to version 2.5.2 is vulnerable due to improper handling of Git credentials, allowing an attacker to inject malicious shell commands through crafted usernames or tokens. This vulnerability can lead to unauthorized access or modification of Home Assistant configuration data, executing commands with the operating system privileges of Home Assistant. Users of Blueprint Studio should prioritize upgrading to version 2.5.2 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable helper script content without validating credential values. An attacker able to set Git credentials could include newline characters or shell syntax in a username or token. When Git executed the generated credential helper, the injected shell commands ran with the operating-system privileges of Home Assistant and could access or modify Home Assistant configuration data. This issue is fixed in version 2.5.2.