Blueprint Studio, a VS Code–style editor for Home Assistant configurations, stored Git usernames and access tokens in the .git-credentials file using Git's credential.helper store before version 2.5.2. The credentials were written in plaintext, allowing any user or process that could read the file to obtain the tokens, which are effectively password equivalent for the associated Git repositories. This flaw enabled unintended disclosure of authentication information that was meant to be confined to Home Assistant's internal storage.

All installations of ha‑china:blueprint‑studio running any release earlier than 2.5.2 are affected. The vulnerability occurs when Blueprint Studio saves Git credentials while the Home Assistant environment is active; users running Home Assistant on the same machine or with sufficient filesystem permissions would be able to read the leaked credentials.

The flaw carries a CVSS score of 6.9, indicating moderate severity. The EPSS score is < 1%, indicating a low likelihood of exploitation, and the vulnerability has not been listed in the CISA KEV catalog. An attacker would need local access to the Home Assistant instance’s user account or the underlying filesystem, making the attack vector a local compromise or privilege escalation. Once the .git-credentials file is read, an attacker can use the exposed tokens to access any Git repositories the Home Assistant configuration was paired with, potentially exfiltrating code, configuration files, or other sensitive data.