{"id":"CVE-2026-71259","published":"2026-08-05T13:24:49.993","lastModified":"2026-08-10T12:17:28.283","description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","cvssScore":8.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-184"],"vendors":[],"products":[],"references":[{"url":"https://github.com/esphome/esphome","tags":[]},{"url":"https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py","tags":[]}],"exploitRefs":[{"url":"https://github.com/esphome/esphome","tags":[]},{"url":"https://github.com/esphome/esphome/blob/dev/esphome/config_validation.py","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw is an operator-precedence bug in the cv.url validator, allowing any file: URI to pass validation, which can lead to unauthorized access to external components.","exploitability":"Exploitation is relatively easy as any file: URI can bypass validation, requiring only the correct URI format.","blast_radius":"If exploited, this could lead to unauthorized access to local files, potentially allowing attackers to execute arbitrary code or modify system configurations.","remediation":"Upgrade to the fixed version 2026.7.0 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","file-access","validation-bug"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-02T08:49:04.377Z"}}