Description

An OS command injection vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to execute arbitrary system commands on Xiaomi smart speakers running the patch. The /mute and /unmute endpoint handlers in api/main.py pass the user-supplied silent query parameter directly to os.system() without sanitization, enabling command injection via shell metacharacters.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-10T11:17:30.897Z",
  "pubdate": "2026-08-10T11:17:30.897Z",
  "executiveSummary": "An OS command injection vulnerability exists in duhow/xiaoai-patch through commit fb07049, affecting Xiaomi smart speakers running the patch. The vulnerability resides in the /mute and /unmute endpoint handlers within api/main.py, where the user-supplied silent query parameter is passed directly to the operating system's command interpreter without prior sanitization or validation.\nThis flaw allows a remote, unauthenticated attacker to execute arbitrary system commands with the privileges of the underlying application. Successful exploitation leads to complete remote code execution, compromising the confidentiality, integrity, and availability of the affected smart speaker device.\nThe risk implications are severe, as exploitation requires only network access to the vulnerable endpoints exposed by the application, granting an external attacker unauthorized control over the host operating system.",
  "technicalDetails": "The vulnerability is fundamentally rooted in unsafe input handling and lack of sanitization within the application logic. Specifically, the vulnerable component consists of the /mute and /unmute endpoint handlers defined in api/main.py of the duhow/xiaoai-patch repository through commit fb07049.\nWhen a client sends a request to either the /mute or /unmute endpoints, the application extracts the user-supplied silent query parameter from the incoming HTTP request. Without validating, escaping, or filtering the input for shell metacharacters, the application concatenates or passes this parameter directly into a call to os.system().\nBecause os.system() invokes a standard shell to execute the passed string, an attacker can supply specially crafted inputs containing shell metacharacters such as semicolons, pipes, or backticks. This alters the syntax of the intended command string, causing the underlying operating system shell to sequentially execute the attacker-supplied arbitrary system commands alongside or instead of the intended application logic.\nThe attack flow proceeds as follows: First, the remote attacker identifies the network exposure of the target Xiaomi smart speaker running the vulnerable duhow/xiaoai-patch. Second, the attacker crafts an HTTP GET or POST request targeting the /mute or /unmute endpoints. Third, the attacker injects malicious OS commands embedded within the silent query parameter using shell metacharacters. Fourth, the application processes the request in api/main.py and insecurely passes the unsanitized parameter to os.system(). Finally, the operating system executes the injected payload, granting the remote attacker arbitrary command execution capabilities on the device."
}