CVE-2026-40602

Katalog CVE

CVSS 5.6 · Medium EPSS 0,15%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada home-assistant-ecosystem home assistant command-line interface. Skor CVSS 3.1 5.6 (Medium) menurut github.com.

Deskripsi (NVD)

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.6 (Medium), sumber github.com
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

EPSS (30 hari)

0,15% peluang dieksploitasi; lebih tinggi dari 3,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/home-assistant-ecosystem/home-assistant-cli/security/advisories/GHSA-33qf-q99x-wpm8 mitigasi · advisory vendor
• https://github.com/home-assistant-ecosystem/home-assistant-cli/pull/453 issue tracking