CVE-2026-40602 Details
Description
The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.
A vulnerability in the Home Assistant Command-line interface (hass-cli) prior to version 1.0.0 allows for unrestricted handling of user-supplied Jinja2 templates. This lack of restriction enabled access to Python's internals, potentially leading to arbitrary code execution on the local machine. The vulnerability arises from rendering templates with no oversight, allowing malicious Jinja2 expressions to be executed. Exploitation requires user intervention, such as downloading and rendering harmful templates with the command-line interface.
Users should update to version 1.0.0 or later, which addresses the vulnerability by introducing an 'ImmutableSandboxedEnvironment' for Jinja2 template handling. Additionally, templates can be evaluated manually or with a tool before rendering them with hass-cli.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/home-assistant-ecosystem/home-assistant-cli/pull/453 | [email protected] | Issue Tracking |
| https://github.com/home-assistant-ecosystem/home-assistant-cli/security/advisories/GHSA-33qf-q99x-wpm8 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| home-assistant-ecosystem home assistant command-line interface | < 1.0.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |