EUVD-2026-61483Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible to any authenticated Home Assistant user (PR:L, AV:N), with only low confidentiality impact from path/detail leakage and no integrity or availability effect.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.
AnalysisAI
Blueprint Studio, a VS Code-like configuration file editor for Home Assistant (versions prior to 2.5.2), exposed internal filesystem paths and implementation details through raw Python exception strings returned directly in HTTP API responses. Any authenticated Home Assistant user - not only administrators - could trigger these disclosures by sending unexpected input to the backend API. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid Home Assistant user account at any privilege level - the pre-patch API did not enforce admin-only access, so any authenticated user could reach the vulnerable handlers. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 and VC:L classification correctly reflect a moderate, bounded risk - this is an information disclosure enabling reconnaissance, not direct code execution or privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Blueprint Studio to version 2.5.2 or later, released 2026-05-26, available at https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today