CVE-2026-53454
Blueprint Studio stored Git credentials in plaintext Git credential store
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 18, 2026
- Updated
- Aug 21, 2026
- Reserved
- Jun 9, 2026
Description
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action. This issue is fixed in version 2.5.2.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | GitHub_M |
Weaknesses
- CWE-522 Insufficiently Protected Credentials
Affected Products
| Product | Versions |
|---|---|
blueprint-studioha-china |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.