CVE-2026-71259

Name of the Vulnerable Software and Affected Versions ESPHome versions prior to 2026.7.0-dev

Description An operator-precedence bug exists in the cv.url() validator within esphome/config validation.py. Due to the and operator binding tighter than or, any file: URI passes validation regardless of the network location. This validator controls the url: field of the external components YAML directive's git source schema, which is subsequently passed to git clone. An attacker can use a crafted external components block with a url pointing to a local path, such as file:///attacker/repo, to clone an attacker-controlled local directory. This directory is then added to the Python import machinery via the ESPHome component loader, allowing the execution of arbitrary Python code when the YAML configuration is processed through commands like esphome config or esphome run.

Recommendations Update ESPHome to a version later than 2026.7.0-dev.