Threats tagged 'ghsa-mxx3-r9xg-4hf6'

CVE-2026-72581 is a server-side request forgery (SSRF) vulnerability in the duhow/xiaoai-patch project. It allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The vulnerability exists because the /auth endpoint in api/main.py uses a user-supplied URL parameter without validating the destination, enabling potential internal network scanning and access to internal services.