EUVD-2026-61485Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Credential theft requires only local filesystem read access (AV:L, PR:L); reading a plaintext file is trivial (AC:L) with no user interaction and no integrity or availability impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action. This issue is fixed in version 2.5.2.
AnalysisAI
Blueprint Studio versions prior to 2.5.2 exposed Git usernames and personal access tokens in plaintext on the filesystem by misconfiguring Git's credential.helper store when an admin saved Git credentials through the interface. The resulting .git-credentials file persists beyond Blueprint Studio's intended storage scope and can be read by any user or process sharing the same filesystem context as the Home Assistant instance. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions to be met simultaneously: first, an authenticated Home Assistant admin user must have previously saved Git credentials through Blueprint Studio's interface, causing the .git-credentials file to be written; second, the attacker or malicious process must have read access to the filesystem path where .git-credentials is stored (typically the home directory of the user running Home Assistant). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.9 with PR:H correctly captures that the misconfiguration is triggered only by an authenticated admin saving Git credentials - this is not a zero-interaction condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Blueprint Studio to version 2.5.2 or later, released 2026-05-26 and available at https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today