EUVD-2026-61487Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with high complexity because cleanup failure or crash must occur; PR:H for config directory access; confidentiality-only impact from key disclosure.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
3DescriptionCVE.org
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key. This issue is fixed in version 2.5.2.
AnalysisAI
SSH private key material in Blueprint Studio versions prior to 2.5.2 was temporarily written to disk under the Home Assistant configuration directory during terminal SSH authentication sessions, with permissions hardened only after the write and cleanup performed on a best-effort basis. Any user or co-located process with read access to the HA configuration directory could recover the residual key if cleanup was skipped due to a crash or exception. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be simultaneously true: (1) Blueprint Studio's terminal feature is configured to use SSH key authentication - installations that do not use this specific terminal feature are not affected; (2) the attacker has local read access to the Home Assistant configuration directory, which in practice means either a privileged OS account, a co-located process or add-on with config directory access, or physical access to the host; (3) a cleanup failure occurred - either because Home Assistant crashed before the deletion step ran, or an exception prevented cleanup. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.6 (Medium) with AV:L, PR:H, and AT:P accurately reflects a tightly constrained attack surface: exploitation requires local filesystem access to the HA configuration directory, high privileges on the vulnerable system, and the specific condition that the SSH key authentication feature is in active use with a cleanup failure or crash. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Blueprint Studio to version 2.5.2 or later, available at https://github.com/ha-china/blueprint-studio/releases/tag/v2.5.2 and documented in the security advisory GHSA-3vg8-xf27-7q45 at https://github.com/ha-china/blueprint-studio/security/advisories/GHSA-3vg8-xf27-7q45. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today