Vulnerability Description
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source schema, which is passed to `git clone` (git supports file:// natively). A crafted `external_components` block with `url: "file:///attacker/repo"` clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via `esphome config`/`esphome run`).
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/esphome/esphome
- https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py
FAQ
What is CVE-2026-71259?
CVE-2026-71259 is a vulnerability with a CVSS score of 8.6 (HIGH). ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parse...
How severe is CVE-2026-71259?
CVE-2026-71259 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-71259?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.