CVE-2026-40602

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-40602

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40602.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-40602

Aliases

Published

2026-04-21T17:40:10.251Z

Modified

2026-07-15T01:49:13.957312631Z

Severity

5.6 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N CVSS Calculator

Summary

hass-cli: Handling of user-supplied Jinja2 templates

Details

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.

Database specific

{
    "cwe_ids": [
        "CWE-1336",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40602.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/home-assistant-ecosystem/home-assistant-cli

Affected ranges

Type

GIT

Repo

https://github.com/home-assistant-ecosystem/home-assistant-cli

Events

Introduced

Fixed

539fb0be61e0834eddfd252afaa7fadd169397f1

Database specific

{
    "cpe": "cpe:2.3:a:home-assistant-ecosystem:home_assistant_command-line_interface:*:*:*:*:*:*:*:*",
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.0"
        }
    ]
}

Affected versions

0.*

0.1.0

0.3.0

0.3.1

0.4.0

0.4.1

0.4.4

0.5.0

0.7.0

0.8.0

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

Other

untagged-833e7f9176e1e602853d

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-40602.json"