JurajNyiri HomeAssistant-Tapo-Control issues.yml code injection

Summaryinfo

A vulnerability, which was classified as critical, has been found in JurajNyiri HomeAssistant-Tapo-Control. Affected is an unknown function of the file github/workflows/issues.yml. This manipulation causes code injection. The identification of this vulnerability is CVE-2025-55192. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in JurajNyiri HomeAssistant-Tapo-Control (affected version unknown). It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file github/workflows/issues.yml. The manipulation with an unknown input leads to a code injection vulnerability. The CWE definition for the vulnerability is CWE-94. The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

HomeAssistant-Tapo-Control offers Control for Tapo cameras as a Home Assistant component. Prior to commit 2a3b80f, there is a code injection vulnerability in the GitHub Actions workflow .github/workflows/issues.yml. It does not affect users of the Home Assistant integration itself — it only impacts the GitHub Actions environment for this repository. The vulnerable workflow directly inserted user-controlled content from the issue body (github.event.issue.body) into a Bash conditional without proper sanitization. A malicious GitHub user could craft an issue body that executes arbitrary commands on the GitHub Actions runner in a privileged context whenever an issue is opened. The potential impact is limited to the repository’s CI/CD environment, which could allow access to repository contents or GitHub Actions secrets. This issue has been patched via commit 2a3b80f. Workarounds involve disabling the affected workflow (issues.yml), replacing the unsafe Bash comparison with a safe quoted grep (or a pure GitHub Actions expression check), or ensuring minimal permissions in workflows (permissions: block) to reduce possible impact.

The advisory is shared at github.com. This vulnerability is known as CVE-2025-55192 since 08/08/2025. The exploitation appears to be easy. The attack can be launched remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1059 for this issue.

Applying the patch 2a3b80ff128ddf4f410c97dd47a94343792ce43c is able to eliminate this problem. The bugfix is ready for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-24879). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• JurajNyiri

Name

• HomeAssistant-Tapo-Control

License

• open-source

Website

• Product: https://github.com/JurajNyiri/HomeAssistant-Tapo-Control/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion