PT-2026-33382 · Unknown · Homeassistant-Cli

Heyitspiyush · Published 2026-04-16 · Updated 2026-04-21 · CVE-2026-40602

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions home-assistant-cli versions prior to 1.0.0

Description The Home Assistant Command-line interface (hass-cli) used an unrestricted environment instead of a sandboxed one to handle Jinja2 templates. User-supplied input within these templates was rendered locally without restrictions, allowing access to Python internals and extending templating capabilities beyond intended usage. This can lead to arbitrary code execution on the local machine if a user is convinced to render malicious third-party templates using the --local flag. The issue only affects the local machine and requires user intervention.

Recommendations Update to version 1.0.0. Evaluate Jinja2 templates manually or using a tool before rendering them with hass-cli.

Fix

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

CVE-2026-40602

GHSA-33QF-Q99X-WPM8

Affected Products

Homeassistant-Cli

References · 7

• https://github.com/home-assistant-ecosystem/home-assistant-cli/security/advisories/GHSA-33qf-q99x-wpm8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40602 · Security Note
• https://osv.dev/vulnerability/GHSA-33qf-q99x-wpm8 · Vendor Advisory
• https://github.com/home-assistant-ecosystem/home-assistant-cli/pull/453 · Note
• https://github.com/home-assistant-ecosystem/home-assistant-cli · Note
• https://twitter.com/infoflowcloud/status/2046676456592249052 · Twitter Post
• https://twitter.com/CVEnew/status/2046675007082832339 · Twitter Post