ESPHome versions through 2026.7.0-dev contain an operator-precedence bug in the cv.url() validator function. This bug causes file:// URIs to bypass proper validation, allowing an attacker to specify a local file path in the external_components YAML directive. When processed, this can lead to cloning attacker-controlled local repositories and executing arbitrary Python code during configuration processing.