CVE-2026-72580 - An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters. - 漏洞详情

漏洞编号：CVE-2026-72580

风险等级：危急

漏洞来源：CVE

CVE 编号：CVE-2026-72580

CNNVD 编号：-

厂商/产品：- / -

影响范围：-

CWE：CWE-78

发布/更新时间：2026-08-10 / 2026-08-28

漏洞描述

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

漏洞描述

相关链接

相关漏洞