{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-71259 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-71259 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-71259 is a high-severity code injection vulnerability in esphome, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2026-71259 and fix it if it is affected.\n\nWhat it is: CVE-2026-71259 is a high-severity code injection vulnerability in esphome, published on 5 Aug 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2026-71259 in the wild and no public exploit code.\n\nAffected product: esphome. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-71259/ (Markdown: https://insights.sbomify.com/CVE-2026-71259/index.md)","id":"CVE-2026-71259","markdown":"https://insights.sbomify.com/CVE-2026-71259/index.md","name":"CVE-2026-71259","record":{"aliases":["GHSA-2g7j-rv69-9w67"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"ESPHome configuration tool","requires_auth":"none","summary":"An operator-precedence bug in ESPHome's URL validator allows bypassing file:// restrictions, enabling remote code execution via malicious external components.","user_interaction":"required","vuln_class":"code_injection"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"TuranSec","cpe":[],"cvss":{"score":8.6,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"}],"description":"ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution","id":"CVE-2026-71259","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"code_injection","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"ESPHome web_server Plaintext Password Disclosure via JSON \"value\" Field","id":"CVE-2026-71260"},"packages":[],"prev":{"headline":"Apache Wicket: Configured file upload limits are not enforced when the multipart request has already been parsed","id":"CVE-2026-71257"},"products":["esphome"],"published":"2026-08-05","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-10","vendors":["esphome"]},"summary":"An operator-precedence bug in ESPHome's URL validator allows bypassing file:// restrictions, enabling remote code execution via malicious external components.","url":"https://insights.sbomify.com/CVE-2026-71259/"}