CVE-2026-72580

Name of the Vulnerable Software and Affected Versions duhow/xiaoai-patch versions prior to commit fb07049

Description An OS command injection flaw allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers. The issue occurs because the /mute and /unmute endpoints in api/main.py pass the silent query parameter directly to the os.system() function without proper sanitization, allowing the use of shell metacharacters to inject commands.

Recommendations Update duhow/xiaoai-patch to a version beyond commit fb07049. Avoid using the silent parameter in the /mute and /unmute endpoints until the patch is applied.