felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/home-assistant.md

home-assistant — triage (group D)

Pin: ghcr.io/home-assistant/home-assistant:2026.9.4. Gates: setup_gate.

GHSA-jff5-5j3g-vhqc (low, 2023) — NOT-A-FINDING: GitHub Actions expression injection in the separate

home-assistant/actions repo (helpers/version/action.yml, ecosystem "actions", fixed 2023-09-05); CI, not the product. Release bodies 2026.10.0..2026.10.4: no security mention. Lane: NOT_A_FINDING. No target. Classifier note: skip advisories with package ecosystem "actions".