Folks, not sure where to raise this, but it’s creating some fairly sizeable waves.
Essentially, root privs escalation from any user script. This means a rogue addon, script, etc. could conceivably harvest all creds stored in HA OS.
It feels like HA OS should be applying the mitigation as a matter of some urgency.
What’s the right place to find updates on this?
Sounds like it’s been patched (which is good news) just hasn’t made it to a new version as of yet (not so good news).
Hoping they push it sooner-vs-later given the amount of 3rd party code people typically run on HA.