CVE-2026-71259: ESPHome RCE Vulnerability via URL Validator

CVE-2026-71259 Overview

CVE-2026-71259 is an operator-precedence flaw in ESPHome through version 2026.7.0-dev that permits arbitrary Python code execution. The bug resides in the cv.url() validator inside esphome/config_validation.py, where boolean operator precedence causes any file: URI to bypass URL validation. Because this validator gates the url: field of the external_components YAML directive, attackers can supply a file:// path to a malicious local repository. ESPHome subsequently invokes git clone on that path and loads the cloned components into Python's import machinery, executing attacker-controlled code when the YAML configuration is processed.

Critical Impact
A crafted external_components block with url: "file:///attacker/repo" triggers arbitrary Python code execution during esphome config or esphome run operations.

Affected Products

ESPHome through 2026.7.0-dev
Systems processing untrusted ESPHome YAML configurations
CI/CD pipelines and Home Assistant add-ons that invoke esphome config or esphome run

Discovery Timeline

2026-08-05 - CVE-2026-71259 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71259

Vulnerability Analysis

The vulnerability [CWE-184] is an incomplete list of disallowed inputs in the ESPHome URL validator. The validator returns a parsed URL when the expression parsed.scheme and parsed.netloc or parsed.scheme == "file" evaluates true. Python evaluates and before or, so any URL with scheme == "file" passes validation regardless of whether netloc is set.

ESPHome uses cv.url() to validate the url: field of the external_components git source schema. The validated value is passed directly to git clone, which natively supports the file:// transport. The resulting clone is registered with ESPHome's component loader and inserted into Python's import path. Any __init__.py in the attacker-controlled repository executes when the component is imported.

Root Cause

The root cause is a logic error in esphome/config_validation.py: if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl(). The missing parentheses around the intended (parsed.scheme and parsed.netloc) grouping allow the file: branch to accept malformed URIs and unvalidated local paths.

Attack Vector

Exploitation requires the victim to process an attacker-supplied YAML configuration that includes an external_components block whose url begins with file://. When the user runs esphome config or esphome run against the YAML, ESPHome clones the local path and loads it as a Python package, executing arbitrary code with the privileges of the ESPHome process.

No verified proof-of-concept code is available in the referenced sources. See the GitHub ESPHome Config Validation source for the vulnerable function.

Detection Methods for CVE-2026-71259

Indicators of Compromise

YAML configuration files containing external_components entries with url: values starting with file://
Unexpected git clone invocations against local filesystem paths originating from ESPHome processes
New or modified directories inside the ESPHome external components cache referencing non-standard local paths

Detection Strategies

Scan ESPHome YAML files across repositories, CI runners, and Home Assistant hosts for the string file:// under external_components
Alert on child processes of esphome that execute git clone file://...
Monitor Python import activity from directories outside expected ESPHome package locations

Monitoring Recommendations

Log all executions of esphome config and esphome run with the YAML path and originating user
Enable process ancestry telemetry to correlate ESPHome invocations with git subprocess execution
Track filesystem writes to the ESPHome components cache and flag unexpected clone sources

How to Mitigate CVE-2026-71259

Immediate Actions Required

Refuse to process ESPHome YAML files from untrusted sources until an upstream fix is applied
Audit existing YAML configurations for any external_components block containing file:// URLs and remove them
Restrict filesystem permissions on directories that ESPHome can read to prevent staging of malicious local repositories

Patch Information

An official fix corrects the operator precedence in cv.url() by grouping the scheme and netloc check as (parsed.scheme and parsed.netloc) or parsed.scheme == "file" and adds explicit rejection of file: URIs in the external_components git source schema. Track the GitHub ESPHome Repository for the release containing the correction and upgrade beyond 2026.7.0-dev.

Workarounds

Pre-validate YAML files with a linter that rejects external_components entries whose url matches ^file://
Run ESPHome inside a container or sandbox with no access to sensitive filesystem paths and no outbound git transports beyond HTTPS
Enforce code review for any change that adds or modifies external_components in shared configuration repositories

bash

# Configuration example: pre-flight check to block file:// external_components
grep -RInE 'external_components:|url:\s*["'\'']?file://' ./config \
  && { echo "Rejecting YAML: file:// external_components detected"; exit 1; } \
  || esphome config ./config/device.yaml