What is GHSA-mxx3-r9xg-4hf6?

GHSA-mxx3-r9xg-4hf6 is a security advisory published by GitHub Security Advisories with High severity. A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049...

Which CVE IDs does GHSA-mxx3-r9xg-4hf6 cover?

GHSA-mxx3-r9xg-4hf6 covers the following CVE IDs: CVE-2026-72581. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mxx3-r9xg-4hf6?

GHSA-mxx3-r9xg-4hf6 has a CVSS v3 base score of 8.6, published by GitHub Security Advisories.

GHSA-mxx3-r9xg-4hf6HighCVSS 8.6

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049...

Vendor

GitHub Security Advisories

Published

August 10, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-72581 →

📋 Description

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-72581
https://github.com/duhow/xiaoai-patch
https://github.com/duhow/xiaoai-patch/blob/main/api/main.py
https://github.com/advisories/GHSA-mxx3-r9xg-4hf6