Skip to content
OpenAdvisories

Product · duhow

xiaoai-patch

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.6
    CVE-2026-72581

    duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint

    A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the …

    duhow xiaoai-patch