Read the docs
TI-2026-29338 Aliases CVE-2026-40602GHSA-33qf-q99x-wpm8

hass-cli: Handling of user-supplied Jinja2 templates

Priority LOW 26CWE-1336Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1336.

Summary

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00103 1st percentileScored 2026-11-07
Fix Fixed home-assistant-cli (home-assistant-ecosystem): 1.0.0homeassistant-cli (PyPI): 1.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
home-assistant-ecosystemhome-assistant-clibefore 1.0.01.0.0Patch availableCNA
—homeassistant-cli (PyPI)before 1.0.01.0.0Patch availableGHSA-33qf-q99x-wpm8
  • home-assistant-cli Vendorhome-assistant-ecosystem Affected before 1.0.0 Fixed in 1.0.0 Patch available CNA
  • homeassistant-cli (PyPI) Vendor— Affected before 1.0.0 Fixed in 1.0.0 Patch available GHSA-33qf-q99x-wpm8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:home-assistant-ecosystem:home_assistant_command-line_interface:*:*:*:*:*:*:*:*before 1.0.0Vulnerablehome-assistant-ecosystem
  • cpe:2.3:a:home-assistant-ecosystem:home_assistant_command-line_interface:*:*:*:*:*:*:*:* Versions before 1.0.0 Vulnerable ·home-assistant-ecosystem

Remediation

  • Fix · CNA home-assistant-cli (home-assistant-ecosystem) Fixed in 1.0.0
  • Fix · GHSA-33qf-q99x-wpm8 homeassistant-cli (PyPI) Fixed in 1.0.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-40602
  2. 2026-10-03 Alias added: GHSA-33qf-q99x-wpm8

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences