What is the CVSS score of CVE-2026-72580?

CVE-2026-72580 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

Which versions of xiaoai-patch are affected by CVE-2026-72580?

The duhow/xiaoai-patch firmware for Xiaomi smart speakers contains a critical OS command injection vulnerability (CVSS 9.8) enabling remote code execution through unvalidated HTTP parameters, with no…

How to fix or mitigate CVE-2026-72580?

Within 24 hours, identify all devices running duhow/xiaoai-patch firmware (through commit fb07049 and earlier versions), isolate them to segregated networks if they have access to sensitive systems or corporate resources, and document the business criticality of affected devices. Within 7 days, implement compensating controls by configuring Web Application Firewall rules or network access controls to block HTTP requests to the /mute and /unmute endpoints, and disable the patch's HTTP API if not operationally required. Within 30 days, transition affected devices to vendor-supported Xiaomi firmware, completely remove the community patch, or apply any available vendor security update; establish ongoing monitoring of duhow and Xiaomi security advisory channels for future patches.

xiaoai-patch CVE-2026-72580

EUVD-2026-55226 CRITICAL

OS Command Injection (CWE-78)

2026-08-10 TuranSec

GHSA-r5pv-g2v7-cgpc

Command Injection Xiaoai Patch

9.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated, low-complexity injection of the silent parameter into os.system yields full code execution (C/I/A:H); AV:N is retained per the input though the LAN-only API service could arguably be AV:A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 11:22 vuln.today

CVE Published

Aug 10, 2026 - 10:41 cve.org

CRITICAL 9.8

DescriptionCVE.org

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

AnalysisAI

OS command injection in duhow/xiaoai-patch (through commit fb07049), a community firmware-patch project for Xiaomi smart speakers, lets remote attackers run arbitrary shell commands on the device. The /mute and /unmute HTTP handlers in api/main.py pass the attacker-controlled silent query parameter straight into os.system(), so shell metacharacters break out of the intended command. Rated CVSS 9.8, but there is no public exploit identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The affected component is the on-device REST API (api/main.py) shipped with xiaoai-patch, a Python service that exposes device-control endpoints on Xiaomi (Xiao AI) smart speakers. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command): user input from the silent query parameter is concatenated into a string handed to Python's os.system(), which invokes /bin/sh -c and therefore interprets shell metacharacters such as ;, |, &&, backticks, and $(). Because the value is never validated, escaped, or passed via a safe argument-array API (e.g. subprocess with a list and no shell), any injected metacharacter is executed by the shell with the privileges of the API process, which on an embedded speaker is typically root or a highly privileged account.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the project repository (https://github.com/duhow/xiaoai-patch) and the vulnerable file (https://github.com/duhow/xiaoai-patch/blob/main/api/main.py), with no fixed version or advisory. The concrete code fix is to stop passing the silent parameter to os.system(): replace the shell call with a no-shell argument array (e.g. subprocess.run([...], shell=False)) and strictly validate silent against an allowlist (it should only ever be a boolean/enumerated state, so reject anything other than expected values). As compensating controls until a fix is applied: restrict network access to the API so only trusted local management hosts can reach the /mute and /unmute endpoints (host firewall / bind to loopback), ensure the speaker's API port is not port-forwarded or exposed to the internet or untrusted Wi-Fi segments, and place the device on an isolated IoT VLAN - the trade-off is that legitimate remote/automation control of mute state will also be blocked until the endpoints are secured. Given it is a community patch, monitor the upstream repository for a corrected commit and rebuild from a fixed revision.