Home Assistant FFmpeg Flaw Lets Attackers Steal Supervisor Tokens and Execute Code as Root

Gbhackers •Divya • July 30, 2026

Assistant’s FFmpeg integration recently came under scrutiny after researchers demonstrated that unsafe argument handling in the Wyoming Assist satellite feature could be exploited to steal Supervisor tokens and ultimately execute commands as root on the host system. The issue arises not from FFmpeg’s core parsing logic but rather from how Assistant incorporates attacker-controlled […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Home Assistant FFmpeg Vulnerability Allows Root Command Execution and File Theft A newly discovered vulnerability in Home Assistant's FFmpeg integration permits attackers to exploit improper input handling to steal sensitive files and execute commands with root privileges. Researchers from elttam identified that unsafe argument handling in the Wyoming Assist satellite feature could lead to the theft of Supervisor tokens. This flaw affects systems using Home Assistant with FFmpeg integration, potentially compromising sensitive information and system control. The vulnerability emphasizes the risks associated with integrating powerful multimedia tools without adequate input validation. As of the latest reports, no patches have been released to address this issue, leaving affected systems vulnerable. Security professionals are advised to monitor their systems for any signs of exploitation. 2 sources 67

Home Assistant FFmpeg Flaw Lets Attackers Steal Supervisor Tokens and Execute Code as Root

The full story

Extracted Entities

Platforms (1)

Tools (1)