The vulnerability in ESPHome arises from an operator-precedence error in the cv.url() validator in esphome/config_validation.py. The conditional statement `if parsed.scheme and parsed.netloc or parsed.scheme == "file"` incorrectly validates any file:// URI regardless of netloc due to the precedence of 'and' over 'or'. This validator is used for the 'url:' field of the external_components YAML directive's git source schema, which is passed to 'git clone'. An attacker can craft a malicious external_components block with a file:// URL pointing to a local attacker-controlled path. This path is cloned and added to Python's import system by ESPHome's component loader, resulting in arbitrary Python code execution when the YAML configuration is processed (e.g., via 'esphome config' or 'esphome run').

Successful exploitation allows an attacker with the ability to modify the YAML configuration to execute arbitrary Python code locally on the system running ESPHome. This can lead to full compromise of the host, including confidentiality, integrity, and availability impacts. The CVSS v3.1 score is 8.6 (High), reflecting local attack vector with low complexity, no privileges required, user interaction required, scope change, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or unauthenticated YAML configurations containing external_components directives with URLs. Restrict access to configuration files and limit who can run ESPHome commands that process YAML configurations to trusted users only.