Incomplete List of Disallowed Inputs

Overview esphome is a Make creating custom firmwares for ESP32/ESP8266 super easy. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs in the url field of the externalcomponents YAML directive due to improper validation in the cv.url function. An attacker can...

CVE-2026-71259: Incomplete List of Disallowed Inputs

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/configvalidation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the externalcomponents YAML directive's git source schema,...