CVE-2026-53457

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2

Description The legacy stateless terminal command execution path in custom components/blueprint studio/backend/terminal manager.py accepts a cwd working-directory parameter. The system only verifies if the directory exists but does not ensure it remains within the Home Assistant configuration directory. This allows an administrator using the restricted terminal helper to select directories outside the intended boundary, enabling access to or modification of host paths permitted by the Home Assistant container and filesystem permissions.

Recommendations Update to version 2.5.2.