CVE-2026-53454 describes an insufficient protection of credentials vulnerability (CWE-522) in ha-china's Blueprint Studio. Before version 2.5.2, Blueprint Studio configured Git's credential.helper to use the 'store' method, which saves credentials in plaintext in the .git-credentials file for the user running Home Assistant. This allowed persistent storage of usernames and access tokens outside Blueprint Studio's intended secure storage, potentially exposing them to other users or processes with access to the same filesystem context. The persistent configuration also affected subsequent Git operations beyond the initial Blueprint Studio action. The vulnerability is resolved in version 2.5.2.

The vulnerability allows plaintext storage of sensitive Git credentials (usernames and access tokens) on the filesystem, which can be read by other users or processes with access to the same filesystem context. This exposure increases the risk of credential theft and unauthorized access to Git repositories. The persistent nature of the credential helper configuration means that later Git operations could also expose these credentials.

Upgrade Blueprint Studio to version 2.5.2 or later, where this issue is fixed. No additional mitigation steps are required as the fix addresses the insecure credential storage behavior.