Skip to content
OpenAdvisories

Vendor

duhow

2 known vulnerabilities.

Products

xiaoai-patch 2
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.8
    CVE-2026-72580

    duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints

    An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-s…

    duhow xiaoai-patch