Threats tagged 'ghsa-r5pv-g2v7-cgpc'

An OS command injection vulnerability exists in the duhow/xiaoai-patch project affecting Xiaomi smart speakers. The vulnerability arises because the /mute and /unmute API endpoints pass a user-supplied parameter directly to os.system() without sanitization, allowing remote attackers to execute arbitrary system commands. This vulnerability has a critical severity score of 9.8 and affects devices running the vulnerable patch version. No specific affected versions or patches have been identified yet.