CVE-2026-71259

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71259
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71259.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71259
Published
2026-08-05T12:26:07.879Z
Modified
2026-08-07T03:47:03.461285248Z
Severity
  • 8.6 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
Details

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/configvalidation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl(). Because and binds tighter than or, any file: URI passes validation regardless of netloc. This validator gates the url: field of the externalcomponents YAML directive's git source schema, which is passed to git clone (git supports file:// natively). A crafted external_components block with url: "file:///attacker/repo" clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via esphome config/esphome run).

Database specific 
{
    "cna_assigner": "TuranSec",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71259.json",
    "cwe_ids": [
        "CWE-184"
    ]
}
References

Affected packages

Git / github.com/esphome/esphome

Affected ranges

Type
GIT
Repo
https://github.com/esphome/esphome
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
920a8b761b680d9864da2ef4b44b4af95c99dba8
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2026.7.0"
        },
        {
            "fixed": "2026.7.0-dev"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

2021.*
2021.10.0
2021.10.0b1
2021.10.0b2
2021.10.1
2021.10.2
2021.10.3
2021.11.0
2021.11.1
2021.11.2
2021.11.3
2021.11.4
2021.12.0
2021.12.1
2021.12.2
2021.12.3
2021.8.0
2021.8.1
2021.8.2
2021.9.0
2021.9.1
2021.9.2
2021.9.3
2022.*
2022.1.0
2022.1.1
2022.1.2
2022.1.3
2022.1.4
2022.10.0
2022.10.1
2022.10.2
2022.11.0
2022.11.1
2022.11.2
2022.11.3
2022.11.4
2022.11.5
2022.12.0
2022.12.1
2022.12.2
2022.12.3
2022.12.4
2022.12.5
2022.12.6
2022.12.7
2022.12.8
2022.2.0
2022.2.1
2022.2.2
2022.2.3
2022.2.4
2022.2.5
2022.2.6
2022.3.0
2022.3.1
2022.3.2
2022.4.0
2022.5.0
2022.5.1
2022.6.0
2022.6.1
2022.6.2
2022.6.3
2022.8.0
2022.8.1
2022.8.2
2022.8.3
2022.9.0
2022.9.1
2022.9.2
2022.9.3
2022.9.4
2023.*
2023.10.0
2023.10.1
2023.10.2
2023.10.3
2023.10.4
2023.10.5
2023.10.6
2023.11.0
2023.11.1
2023.11.2
2023.11.3
2023.11.4
2023.11.5
2023.11.6
2023.12.0
2023.12.1
2023.12.2
2023.12.3
2023.12.4
2023.12.5
2023.12.6
2023.12.7
2023.12.8
2023.12.9
2023.2.0
2023.2.1
2023.2.2
2023.2.3
2023.2.4
2023.3.0
2023.3.1
2023.3.2
2023.4.0
2023.4.1
2023.4.2
2023.4.3
2023.4.4
2023.5.0
2023.5.1
2023.5.2
2023.5.3
2023.5.4
2023.5.5
2023.6.0
2023.6.1
2023.6.2
2023.6.3
2023.6.4
2023.6.5
2023.7.0
2023.7.1
2023.8.0
2023.8.1
2023.8.2
2023.8.3
2023.9.0
2023.9.1
2023.9.2
2023.9.3
2024.*
2024.10.0
2024.10.1
2024.10.2
2024.10.3
2024.11.0
2024.11.1
2024.11.2
2024.11.3
2024.12.0
2024.12.1
2024.12.2
2024.12.3
2024.12.4
2024.2.0
2024.2.1
2024.2.2
2024.3.0
2024.3.1
2024.3.2
2024.4.0
2024.4.1
2024.4.2
2024.5.0
2024.5.1
2024.5.2
2024.5.3
2024.5.4
2024.5.5
2024.6.0
2024.6.1
2024.6.2
2024.6.3
2024.6.4
2024.6.5
2024.6.6
2024.7.0
2024.7.1
2024.7.2
2024.7.3
2024.8.0
2024.8.1
2024.8.2
2024.8.3
2024.9.0
2024.9.1
2024.9.2
2025.*
2025.10.0
2025.10.1
2025.10.2
2025.10.3
2025.10.4
2025.10.5
2025.11.0
2025.11.1
2025.11.2
2025.11.3
2025.11.4
2025.11.5
2025.12.0
2025.12.1
2025.12.2
2025.12.3
2025.12.4
2025.12.5
2025.12.6
2025.12.7
2025.2.0
2025.2.1
2025.2.2
2025.3.0
2025.3.1
2025.3.2
2025.3.3
2025.4.0
2025.4.1
2025.4.2
2025.5.0
2025.5.1
2025.5.2
2025.6.0
2025.6.1
2025.6.2
2025.6.3
2025.7.0
2025.7.1
2025.7.2
2025.7.3
2025.7.4
2025.7.5
2025.8.0
2025.8.1
2025.8.2
2025.8.3
2025.8.4
2025.9.0
2025.9.1
2025.9.2
2025.9.3
2026.*
2026.1.0
2026.1.1
2026.1.2
2026.1.3
2026.1.4
2026.1.5
2026.2.0
2026.2.1
2026.2.2
2026.2.3
2026.2.4
2026.3.0
2026.3.1
2026.3.2
2026.3.3
2026.4.0
2026.4.1
2026.4.2
2026.4.3
2026.4.4
2026.4.5
2026.5.0
2026.5.1
2026.5.2
2026.5.3
2026.6.0
2026.6.1
2026.6.2
2026.6.3
2026.6.4
2026.6.5
v1.*
v1.1
v1.12.0
v1.12.0b1
v1.12.0b2
v1.12.0b3
v1.12.0b4
v1.12.1
v1.12.2
v1.13.0
v1.13.1
v1.13.2
v1.13.3
v1.13.4
v1.13.5
v1.13.6
v1.14.0
v1.14.1
v1.14.2
v1.14.3
v1.14.4
v1.14.5
v1.15.0
v1.15.1
v1.15.2
v1.15.3
v1.16.0
v1.16.1
v1.16.2
v1.17.0
v1.17.1
v1.17.2
v1.18.0
v1.19.0
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.2.1
v1.2.2
v1.20.0
v1.20.1
v1.20.2
v1.20.3
v1.20.4
v1.3.0
v1.4.0
v1.5.0
v1.5.1
v1.5.2
v1.5.3
v1.6.0
v1.6.1
v1.6.2
v1.7.0
v1.8.0
v1.8.1
v1.8.2
v1.9.0b1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71259.json"