CVE-2026-71259

Received Received - Intake

Operator-Precedence Bug in ESPHome URL Validator

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-16

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-15

NVD

CVE-2026-71259

EUVD

EUVD-2026-53344

Affected Vendors & Products

Vendor	Product	Version / Range
esphome	esphome	to 2026.7.0-dev (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-184	The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

Executive Summary

ESPHome versions up to 2026.7.0-dev contain a bug in the URL validation logic where operator precedence causes file: URIs to bypass proper checks. This allows an attacker to specify a malicious local path in a configuration file, which gets executed as Python code when the system processes the YAML configuration.

Detection Guidance

Check ESPHome configuration files for external_components blocks with file:// URLs. Inspect YAML files for patterns like url: "file:///attacker/repo". Review git clone commands executed by ESPHome for suspicious local path references.

Impact Analysis

An attacker could exploit this to execute arbitrary Python code on your system by tricking you into processing a specially crafted YAML configuration file. This could lead to full system compromise, data theft, or unauthorized device control if ESPHome is used in a home automation setup.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is accessed or exfiltrated. Organizations using ESPHome in regulated environments may face compliance violations due to insufficient input validation.

Mitigation Strategies

Update ESPHome to the latest version beyond 2026.7.0-dev. Remove any external_components configurations using file:// URLs. Validate all YAML files before processing with esphome config or esphome run.

Hi! I’m here to help you understand CVE-2026-71259. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70