CVE-2026-40602
hass-cli: Handling of user-supplied Jinja2 templates
CVSS Score
5.6
EPSS Score
0.0%
EPSS Percentile
0th
The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.
| CWE | CWE-94 CWE-1336 |
| Vendor | home-assistant-ecosystem |
| Product | home-assistant-cli |
| Published | Apr 21, 2026 |
| Last Updated | Apr 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for home-assistant-ecosystem home-assistant-cli
Be the first to know when new medium vulnerabilities affecting home-assistant-ecosystem home-assistant-cli are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N Attack Vector
Local
Attack Complexity
High
Privileges Required
High
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
home-assistant-ecosystem / home-assistant-cli
< 1.0.0