xiaoai-patch vulnerabilities

2 known vulnerabilities in xiaoai-patch from Duhow. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  xiaoai-patch: Server-Side Request Forgery

  CVE-2026-72581Aug 10, 2026Duhow

  A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the u

• 9.8 Critical severity

  xiaoai-patch: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-72580Aug 10, 2026DuhowEPSS 1.65%

  An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-su