CVE-2026-71259: ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema, which is passed to (git supports file:// natively).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71259?
The severity of CVE-2026-71259 is high with a score of 8.6.
What are the potential impacts of CVE-2026-71259?
CVE-2026-71259 can lead to remote code execution due to a validation bypass in the ESPHome configuration.
How do I fix CVE-2026-71259?
To fix CVE-2026-71259, you should update to the latest version of ESPHome that addresses this vulnerability.
What software is affected by CVE-2026-71259?
CVE-2026-71259 affects ESPHome versions through 2026.7.0-dev.
What is the cause of CVE-2026-71259?
CVE-2026-71259 is caused by an operator-precedence bug in the cv.url() validator in the ESPHome configuration validation.