CVE-2026-107780 in Skyeye
Summary
by MITRE • 10/09/2026
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The Dromara Skyeye application, specifically up through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321, contains a critical operating system command injection vulnerability within its text-to-speech functionality. This flaw resides in the unauthenticated endpoint /post/TtsController/textToSpeech and is triggered by improper handling of input provided via the format parameter. The security issue stems from the application's failure to adequately sanitize or validate user-supplied data before incorporating it into a system-level command execution context. Because this specific endpoint does not require authentication, any remote actor on the network can exploit this weakness without needing valid credentials, significantly lowering the barrier for entry and increasing the potential attack surface considerably.
The technical mechanism of exploitation relies on the application's internal logic which constructs PowerShell commands to process text-to-speech requests. When a user submits data through the format parameter, the backend code directly interpolates this input into a string that is subsequently passed to the operating system shell for execution. By injecting a single quote character into the format field, an attacker can break out of the intended PowerShell string delimiter. This syntactic escape allows the injection of arbitrary command-line arguments or full commands that are then executed by the underlying process with the privileges assigned to the Skyeye service account on Windows systems.
The operational impact of this vulnerability is severe due to the principle of least privilege often applied to service accounts, which may still possess sufficient permissions to compromise system integrity and confidentiality. Successful exploitation allows an attacker to execute arbitrary commands as the user context under which the Dromara Skyeye application runs. This can lead to full remote code execution on the affected host, enabling actions such as data exfiltration, installation of malware, pivoting to other internal systems, or complete denial of service by disrupting critical services. The ability to run commands without authentication makes this a high-severity issue that demands immediate remediation attention from system administrators and development teams responsible for maintaining the Dromara Skyeye infrastructure.
From a classification perspective, this vulnerability aligns with CWE-78 Improper Neutralization of Special Elements used in an OS Command commonly known as OS Command Injection. The attack vector is categorized under ATT&CK technique T1059 Command and Scripting Interpreter, specifically PowerShell execution on Windows platforms. Mitigation strategies should focus primarily on input validation and output encoding to prevent shell metacharacters from being interpreted by the command processor. Developers must ensure that all user inputs are strictly validated against a whitelist of allowed characters or values before they are used in system commands. Additionally, implementing parameterized APIs for command execution rather than string concatenation can effectively neutralize this class of vulnerabilities. Restricting the permissions of the service account running the application to only those absolutely necessary for its function will also limit the potential blast radius if an exploitation attempt is successful.