Home Assistant FFmpeg Vulnerability Allows File Theft and Root Command Execution
A vulnerability in Home Assistant's Wyoming integration allows attackers to steal sensitive files and execute root commands by manipulating FFmpeg inputs.
A critical vulnerability discovered in Home Assistant's Wyoming integration allows attackers to steal sensitive files and execute root commands on affected systems. The flaw, detailed by researchers at elttam, stems from improper handling of FFmpeg inputs within the platform's audio playback functionality.
Home Assistant, a popular open-source smart home platform, relies on FFmpeg for processing media streams. The vulnerability arises because user-supplied input is passed directly as a command argument to FFmpeg, enabling argument injection. While direct command injection is not possible, attackers can manipulate how FFmpeg interprets input sources.
Researchers found that although protocols like HTTP and HTTPS were restricted, several FFmpeg pseudo-protocols, including "file:," "concat:," and "subfile:," remained permitted. By chaining these protocols, attackers can bypass validation controls and instruct FFmpeg to read arbitrary local files. A key challenge was FFmpeg's requirement for valid audio input, which sensitive files typically lack.
To overcome this, attackers craft a synthetic audio header by reusing specific byte ranges from an existing binary on the target system. These fragments are then combined using FFmpeg's pseudo-protocols to create a valid stream, allowing the contents of the target file to be processed and exfiltrated. This technique enables the retrieval of sensitive information, such as the SUPERVISOR_TOKEN.
The SUPERVISOR_TOKEN grants privileged access to Home Assistant's supervisor API, which can then be exploited to execute commands as the root user on the host system. This leads to a complete compromise of the Home Assistant instance and potentially the underlying operating system.
Exploitation requires an attacker to control a Wyoming Assist satellite paired with the target instance and possess a valid Home Assistant API token to trigger the vulnerable announce endpoint. Despite these prerequisites, the attack poses a significant risk in environments where attackers have already gained limited network access.
The vulnerability has been patched in Home Assistant Core version 2026.6.2. The fix implements a strict protocol allowlist for FFmpeg, restricting input sources to safe options like HTTP, HTTPS, file, TCP, and TLS. This ensures the allowlist is applied before FFmpeg's argument parsing, preventing bypasses.
This incident underscores the importance of secure integration practices, particularly when incorporating powerful tools like FFmpeg into complex applications. As smart home platforms evolve, maintaining robust input validation and component security is crucial to prevent sophisticated attack chains.