CVE-2026-71259
Received Received - Intake

Operator-Precedence Bug in ESPHome URL Validator

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source schema, which is passed to `git clone` (git supports file:// natively). A crafted `external_components` block with `url: "file:///attacker/repo"` clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via `esphome config`/`esphome run`).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71259
EUVD
EUVD-2026-53344

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
esphome esphome to 2026.7.0-dev (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-184 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ESPHome versions up to 2026.7.0-dev contain a bug in the URL validation logic where operator precedence causes file: URIs to bypass proper checks. This allows an attacker to specify a malicious local path in a configuration file, which gets executed as Python code when the system processes the YAML configuration.

Detection Guidance

Check ESPHome configuration files for external_components blocks with file:// URLs. Inspect YAML files for patterns like url: "file:///attacker/repo". Review git clone commands executed by ESPHome for suspicious local path references.

Impact Analysis

An attacker could exploit this to execute arbitrary Python code on your system by tricking you into processing a specially crafted YAML configuration file. This could lead to full system compromise, data theft, or unauthorized device control if ESPHome is used in a home automation setup.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA if sensitive data is accessed or exfiltrated. Organizations using ESPHome in regulated environments may face compliance violations due to insufficient input validation.

Mitigation Strategies

Update ESPHome to the latest version beyond 2026.7.0-dev. Remove any external_components configurations using file:// URLs. Validate all YAML files before processing with esphome config or esphome run.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart