The vulnerability is an operator‑precedence bug in ESPHome’s URL validator used by the external_components feature, corresponding to CWE-184: Incorrect Evaluation of Boolean Expressions. Because the binding operator evaluates tighter than the comparison, any file URI passes validation regardless of its netloc. This validator gate‑checks the field of the external_components YAML directive’s git source schema, which is passed to git, which supports file:// natively. As ESPHome’s component loader streams the cloned repository into Python’s import machinery, a maliciously crafted YAML configuration can cause arbitrary Python code to be loaded and executed when the configuration is processed by commands such as esphome config or esphome run.

This flaw impacts the ESPHome platform, including the 2026.7.0‑dev release and earlier builds that have not applied the patch. The vulnerability is present in the main repository hosted at esphome/esphome and is tracked in the file esphome/config_validation.py.

With a CVSS score of 8.6 this flaw, identified as a CWE-184 operator‑precedence bug, is high severity. The EPSS score indicates a very low exploitation probability of < 1% and the flaw is not listed in the CISA KEV catalog, indicating it has not yet been exploited in the wild. Exploitation requires the attacker to inject a malicious external_components block containing a file:// URI that points to a local path on the system running ESPHome, enabling the attacker to clone and execute arbitrary code during configuration validation.