ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url() validator in esphome/config_validation.py: "if parsed.scheme and parsed.netloc or parsed.scheme == "file": return parsed.geturl()". Because "and" binds tighter than "or", any file: URI passes validation regardless of netloc. This validator gates the "url:" field of the external_components YAML directive's git source schema, which is passed to "git clone" (git supports file:// natively). A crafted "external_components" block with "url: "file:///attacker/repo"" clones an attacker-controlled local path, which is then added to Python's import machinery via ESPHome's component loader, executing arbitrary Python code when the YAML configuration is processed (e.g. via "esphome config"/"esphome run").