CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

← Back to feed

CVE-2026-71259: ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme ==

highCVSS 8.6CVE-2026-71259
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl(). Because and binds tighter than or, any file: URI passes validation regardless of netloc. This validator gates the url: field of the external_components YAML directive's git source schema, which is passed to git clone (git supports file:// natively). A crafted external_components block with url: "file:///attacker/repo" clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via esphome config/esphome run).

Details

Source
NVD Recent CVEs (US · database · site)
Severity
high — CVSS 8.6
Published
2026-08-05
Last updated
2026-08-05
Exploitation
Not in CISA KEV at last sync

Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-71259

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Referenced CVEs

CVECSIRTS overviewExternal
CVE-2026-71259coverage & exploitation statusNVD · CVE.org

Recent advisories for ESPHome

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

More from NVD Recent CVEs