Operator Precedence Flaw in ESPHome Configuration Validation

CVE-2026-71259

What is CVE-2026-71259?

ESPHome, prior to version 2026.7.0-dev, includes a flaw in the cv.url() validator within its configuration validation process. This issue arises from an operator-precedence bug in the validation logic, where the 'and' operator binds tighter than 'or'. As a result, a valid 'file://' URI can bypass proper validation checks, allowing attackers to exploit the 'url:' field within the external_components YAML directive. By crafting a malicious external_components block, an attacker can specify a URL such as 'file:///attacker/repo'. This action prompts the tool to clone an attacker-controlled local path, which is subsequently injected into Python's import system via ESPHome's component loader. Consequently, this can lead to the execution of arbitrary Python code during the processing of the YAML configuration.

References