CyberSecBulletin

Duhow vulnerabilities

We track 2 vulnerabilities in Duhow products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on August 10, 2026.

2vulnerabilities
1critical
1high
0exploited
9.2average CVSS score

Latest Duhow vulnerabilities

  • 8.6 High severity

    xiaoai-patch: Server-Side Request Forgery

    CVE-2026-72581Duhow

    A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the u

  • 9.8 Critical severity

    xiaoai-patch: Improper Neutralization of Special Elements used in an OS Command

    CVE-2026-72580DuhowEPSS 1.65%

    An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-su