{"id":"CVE-2026-71259","published":"2026-08-05T13:24:49.993","lastModified":"2026-08-10T12:17:28.283","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://github.com/esphome/esphome","tags":[]},{"url":"https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py","tags":[]}],"exploitRefs":[{"url":"https://github.com/esphome/esphome","tags":[]},{"url":"https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows any file: URI to pass validation due to an operator-precedence bug, enabling unauthorized access to local files.","exploitability":"Exploitation is relatively easy as it requires only crafting a specific file: URI without netloc, but the attacker must have write permissions to create or modify configuration files.","blast_radius":"If exploited, this could lead to data exfiltration, code execution, or other unauthorized actions on local systems.","remediation":"Update to the latest version of ESPHome (2026.7.1 or later) which includes a fix for this issue.","tags":["rce","file-inclusion","config-validation","local-privilege-escalation"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-08-11T06:48:18.910Z"}}