CVE-2026-72580: duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints
An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
duhow/xiaoai-patchto a version that resolves this vulnerability.Patch fb07049 - Configuration
Update /mute and /unmute endpoint handlers in api/main.py so the user-supplied silent query parameter is not passed directly to os.system() without sanitization (remove direct shell execution of unsanitized input).
duhow/xiaoai-patch (api/main.py) /mute and /unmute silent parameter handling (os.system input sanitization) = Do not pass user-supplied silent query parameter directly to os.system(); sanitize/validate before use
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72580?
CVE-2026-72580 has a critical severity rating of 9.8.
How does CVE-2026-72580 impact Xiaomi smart speakers?
CVE-2026-72580 allows remote attackers to execute arbitrary system commands on Xiaomi smart speakers running the duhow/xiaoai-patch.
What type of vulnerability is CVE-2026-72580?
CVE-2026-72580 is classified as an OS Command Injection vulnerability.
How can I mitigate CVE-2026-72580?
To mitigate CVE-2026-72580, it is recommended to remove or disable the affected /mute and /unmute endpoints in the duhow/xiaoai-patch software.
When was CVE-2026-72580 published?
CVE-2026-72580 was published on August 10, 2026.