{"id":"CVE-2026-71259","aliases":["EUVD-2026-53344","GHSA-2g7j-rv69-9w67"],"status":"published","title":"ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","severity":{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00174,"percentile":0.06885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-184"],"published":"2026-08-05T12:26:07Z","modified":"2026-10-28T02:30:29Z","products":[{"vendor":"esphome","product":"esphome"}],"references":[{"url":"https://github.com/esphome/esphome","tags":["third-party-advisory","advisory"]},{"url":"https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py","tags":["third-party-advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71259","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-2g7j-rv69-9w67"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71259.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-71259","title":"ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","status":"published","published":"2026-08-05T12:26:07.879Z","modified":"2026-08-10T11:46:20.128Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:19:49.559463Z"}],"euvd":[{"id":"EUVD-2026-53344","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","status":"published","published":"2026-08-05T12:26:07Z","modified":"2026-08-10T11:46:20Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:05.732685Z"}],"ghsa":[{"id":"GHSA-2g7j-rv69-9w67","title":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in...","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == \"file\": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source schema, which is passed to `git clone` (git supports file:// natively). A crafted `external_components` block with `url: \"file:///attacker/repo\"` clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via `esphome config`/`esphome run`).","status":"published","published":"2026-08-05T15:32:19Z","modified":"2026-08-05T15:32:20Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:10:06.632203Z"}],"nvd":[{"id":"CVE-2026-71259","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","status":"published","published":"2026-08-05T13:24:49.993Z","modified":"2026-08-26T17:13:24.8Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T14:12:35.031043Z"}],"osv":[{"id":"CVE-2026-71259","title":"ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","status":"published","published":"2026-08-05T12:26:07.879Z","modified":"2026-10-28T02:30:29.72964665Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-184"],"updated_at":"2026-11-02T15:45:15.164658Z"}]}}