CVE-2026-53458 MEDIUM

CVE-2026-53458: Blueprint Studio API exposed internal exception details

Vendor Ha-China
Product blueprint-studio
Weakness CWE-209 · Error message info leak
Published August 18, 2026
Last update August 19, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant users. Some exception messages could contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks. This issue is fixed in version 2.5.2.

Key dates

02Disclosure timeline

August 18, 2026 CVE published
August 19, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-13535 Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure CVE-2024-13536 1003 Mortgage Application <= 1.87 - Unauthenticated Full Path Disclosure CVE-2025-15526 Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Full Path Disclosure via 'pdf' Parameter CVE-2025-24552 WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability CVE-2024-54366 WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability