A critical vulnerability has been identified in Home Assistant, an open-source smart home platform, stemming from improper handling of FFmpeg inputs. This flaw allows attackers to steal sensitive files and potentially execute commands with root privileges on affected systems.
Home Assistant’s Wyoming integration, particularly its ‘announce’ feature for audio playback, relies on FFmpeg to process media streams. The vulnerability arises because user-supplied input is passed directly to FFmpeg as a command argument. While this doesn’t constitute a traditional command injection, it permits argument injection, enabling attackers to manipulate FFmpeg’s interpretation of input sources.
Security researchers discovered that, although certain protocols like HTTP and HTTPS were restricted to prevent server-side request forgery, several FFmpeg pseudo-protocols remained accessible. These include ‘file:’, ‘concat:’, and ‘subfile:’, which can be combined to create complex input streams. By exploiting these protocols, attackers can bypass validation controls and instruct FFmpeg to read arbitrary local files.
One challenge in exploiting this vulnerability is FFmpeg’s requirement for valid audio input. Directly reading sensitive files, such as ‘/proc/self/environ,’ fails because they lack proper audio headers. To circumvent this, researchers developed a technique that constructs a synthetic audio header by reusing specific byte ranges from an existing binary on the target system. These fragments are combined using FFmpeg’s pseudo-protocols to create a valid stream, allowing the target file’s contents to be processed and exfiltrated.
Through this method, attackers can retrieve environment variables, including the highly sensitive SUPERVISOR_TOKEN. This token grants privileged access to Home Assistant’s supervisor API, which can be exploited to execute commands as the root user on the host system, leading to a complete compromise of the Home Assistant instance and potentially the underlying operating system.
Exploitation requires specific conditions: the attacker must control a Wyoming Assist satellite paired with the target instance, typically necessitating local network access during setup. Additionally, a valid Home Assistant API token is needed to trigger the vulnerable announce endpoint. Despite these constraints, the attack poses a significant risk, especially in environments where attackers have already gained limited access.
The issue has been addressed in Home Assistant Core version 2026.6.2. The fix introduces a strict protocol allowlist for FFmpeg, limiting allowed input sources to safe options such as HTTP, HTTPS, file, TCP, and TLS. Crucially, the patch ensures that the allowlist is applied before the input argument, preventing any bypasses due to FFmpeg’s argument-parsing behavior.
This vulnerability highlights the importance of rigorous input validation when integrating powerful tools like FFmpeg into applications. As smart home platforms continue to expand their capabilities, ensuring secure interactions between components is essential to prevent complex attack chains.
