Remote Code Execution Vulnerability Discovered in Home Assistant Green’s go2rtc Component
What Happened — A command‑injection flaw (ZDI‑26‑560 / CVSS 7.5) was found in the go2rtc process used by Home Assistant Green. An attacker who can reach the device’s localhost interface can inject an arbitrary string that is executed as a system call, resulting in root‑level code execution. The issue was patched in go2rtc v1.9.14 and the corresponding Home Assistant release.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses the “secure development” controls (SOC 2 CC6.1) that require input validation and protection against code injection.
- Continuous‑compliance programs must evidence that such vulnerabilities are tracked, patched, and that remediation is documented as audit‑ready evidence.
- Verisq’s Control Mapping capability lets you map this type of code‑injection risk to the relevant SOC 2 controls and automatically collect remediation evidence for auditors.
Who Is Affected – Smart‑home / IoT vendors, SaaS platforms that embed Home Assistant, and any organization that runs Home Assistant Green in production environments.
Recommended Actions
- Upgrade go2rtc to v1.9.14 or later and apply the latest Home Assistant patch.
- Verify that localhost access is restricted to trusted processes only (network segmentation, firewall rules).
- Add automated scanning for command‑injection patterns to your CI/CD pipeline and map the finding to SOC 2 CC6.1.
- Record the patching activity in your continuous‑compliance evidence store.
Source: Zero Day Initiative Advisory ZDI‑26‑560
Technical Notes – The vulnerability is a classic unsanitized‑input → system‑call issue (AV:A, AC:H, PR:N, UI:N, S:U, C:H, I:H, A:H). Exploitation requires network‑adjacent access to the localhost interface, after which arbitrary commands run as root. No public exploits have been observed yet.