Read the docs

duhow

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

duhow records in CISA KEV

No duhow vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-50838 CVE-2026-72580 · GHSA-r5pv-g2v7-cgpc

duhow xiaoai-patch - OS Command Injection in /mute and /unmute Endpoints

Priority MEDIUM 52

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01655 Published 2026-08-10 No fix listed CWE-78
TI-2026-50839 CVE-2026-72581 · GHSA-mxx3-r9xg-4hf6

duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint

Priority MEDIUM 44

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00498 Published 2026-08-10 No fix listed CWE-918
Open these records in search →