CyberRota Analysis
AI-GeneratedESPHome versions up to 2026.7.0-dev are vulnerable due to an operator-precedence bug in the URL validation logic, allowing any `file:` URI to bypass validation checks. This flaw enables attackers to craft malicious `external_components` blocks that can clone arbitrary local repositories, leading to the execution of arbitrary Python code during configuration processing. Users of ESPHome, particularly those utilizing external components in their configurations, should prioritize addressing this vulnerability to mitigate the risk of code execution attacks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).