CVE-2026-92993

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript in the file server/internal/machine/api/machine_script.go of the Machine Script Feature component. The manipulation of the argument params results in OS command injection. The attack can be executed remotely, and the exploit is now public. Exploitation needs no admin account — any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders. The vendor did not respond to the disclosure.

A low-privileged attacker can execute arbitrary commands on remote machines, potentially leading to full system compromise. The public exploit increases the risk of rapid exploitation.

Restrict access to the Machine Script Feature and the machine:script:run permission to trusted users. Monitor logs for suspicious calls and consider implementing additional input validation, as the vendor has not released a fix.