CVE-2026-53454 describes an insufficient protection of credentials vulnerability (CWE-522) in ha-china's Blueprint Studio. Before version 2.5.2, Blueprint Studio configured Git's credential.helper to use the 'store' method when saving Git credentials, causing usernames and access tokens to be saved in plaintext in the .git-credentials file of the user running Home Assistant. This persisted beyond the immediate Blueprint Studio operation, affecting subsequent Git commands and exposing credentials to other users or processes with access to the same filesystem context. The vulnerability is resolved in Blueprint Studio version 2.5.2.

The vulnerability allows sensitive Git credentials, including usernames and access tokens, to be stored in plaintext on disk in a location accessible to other users or processes sharing the filesystem context. This exposure could lead to unauthorized access to Git repositories or other resources accessible via these credentials. The issue affects all operations using the persistent credential helper configuration until the software is updated.

This vulnerability is fixed in Blueprint Studio version 2.5.2. Users should upgrade to version 2.5.2 or later to ensure Git credentials are properly protected. Patch status is not explicitly confirmed beyond this fix version; users should verify with the vendor advisory for current remediation guidance.