CVE-2026-71259

ESPHome URL validator bug allows code execution via a malicious YAML file.

• CVSS 8.6
• 184
• Input Validation and Sanitization
• Local

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: `if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()`. Because `and` binds tighter than `or`, any file: URI passes validation regardless of netloc. This validator gates the `url:` field of the external_components YAML directive's git source schema, which is passed to `git clone` (git supports file:// natively). A crafted `external_components` block with `url: "file:///attacker/repo"` clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via `esphome config`/`esphome run`).

CVE

CVE-2026-71259

CWE

184

CVSS base score

8.6

Published

2026-08-05

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Input Validation and Sanitization

Subcategory

Command Injection

Accessibility scope

Local

Impact

Arbitrary Code Execution

Affected component

ESPHome

Fixed by upgrading

Yes

Solution

Upgrade ESPHome to version 2023.7.1 or later.

from urllib.parse import urlparse

class Invalid(ValueError):
    """General purpose validation error."""

def url(value: str) -> str:
    """A URL validator that is intended to receive a git repository URL."""
    if not isinstance(value, str):
        raise Invalid("Expected a string.")

    parsed = urlparse(value)

    # VULNERABLE: operator precedence allows `file:` URIs to bypass the `netloc` check
    if parsed.scheme and parsed.netloc or parsed.scheme == "file":
        return parsed.geturl()

    raise Invalid(f"Invalid URL: {value}")

from urllib.parse import urlparse

class Invalid(ValueError):
    """General purpose validation error."""

def url(value: str) -> str:
    """A URL validator that is intended to receive a git repository URL."""
    if not isinstance(value, str):
        raise Invalid("Expected a string.")

    parsed = urlparse(value)

    # FIX: The clause allowing the 'file' scheme is removed, preventing local path usage.
    if parsed.scheme and parsed.netloc:
        return parsed.geturl()

    raise Invalid(f"Invalid URL: {value}")

esphome:
  name: malicious-config

esp32:
  board: esp32dev
  framework:
    type: arduino

external_components:
  - source:
      type: git
      url: "file:///tmp/malicious_repo"

@misc{vaitp:cve202671259,
  title        = {{ESPHome URL validator bug allows code execution via a malicious YAML file.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2026},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2026-71259},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2026-71259/}}
}