CVE-2026-53458 describes an information disclosure vulnerability in the Blueprint Studio backend API handlers located in custom_components/blueprint_studio/backend/api.py. Before version 2.5.2, the API returned raw exception strings to authenticated users, which sometimes included sensitive internal filesystem paths or implementation details. This exposure could allow an authenticated user to gather information about the Home Assistant environment, potentially facilitating more targeted attacks. The vulnerability is classified under CWE-209 (Generation of Error Message Containing Sensitive Information).

The vulnerability allows authenticated users to obtain sensitive internal information such as filesystem paths and implementation details through error messages. This information disclosure can help attackers better understand the target environment and refine subsequent attack strategies. However, it requires authentication and does not directly allow remote code execution or privilege escalation.

This issue is fixed in Blueprint Studio version 2.5.2. Users should upgrade to version 2.5.2 or later to remediate this vulnerability. No other mitigation or workaround is specified. Patch status is not explicitly confirmed in vendor advisories, but the description states the issue is fixed in 2.5.2.