CVE-2026-92993 in mayfly-go
Summary
by MITRE • 09/17/2026
A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. The vendor was contacted early about this disclosure but did not respond in any way.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The vulnerability identified within Dromara mayfly-go versions up to 1.11.5 represents a critical remote code execution flaw rooted in improper neutralization of special elements used in an operating system command, commonly categorized under CWE-78. This specific weakness resides in the RunMachineScript function located in the server/internal/machine/api/machine_script.go file, which is part of the Machine Script Feature component. The core technical failure involves the direct manipulation of the params argument without adequate sanitization or validation before it is passed to underlying system commands. Because the application constructs operating system commands using user-supplied input that contains unsanitized special characters such as semicolons, pipes, or ampersands, an attacker can inject arbitrary shell commands into the execution context. This flaw allows for complete compromise of the affected machine's integrity and confidentiality, effectively granting the attacker full control over the underlying operating system environment where the service is running.
The operational impact of this vulnerability is severe due to its remote nature and low barrier to entry for exploitation. The attack can be executed remotely by any authenticated user who possesses the specific permission set including machine:script:run along with tag access, eliminating the need for administrative privileges or high-level system accounts. This significantly expands the potential attacker surface area, as even standard users with limited intended capabilities can escalate their privilege through command injection. Furthermore, the exploit is currently public and actively available in the wild, increasing the likelihood of automated attacks against unpatched systems. The vulnerability affects machines whose templates contain {{.param}} placeholders, indicating that any dynamic parameter passed to these scripts becomes a vector for malicious code execution. This scenario aligns with ATT&CK technique T1059 Command and Scripting Interpreter, where adversaries use system utilities like sh or cmd.exe to execute commands on compromised hosts, facilitating lateral movement and persistence within the network infrastructure.
A critical aggravating factor in this vulnerability is the lack of input filtering at multiple layers of the application stack. Specifically, the SSH exec layer, identified as Cli.Run, applies no input validation whatsoever to any caller interacting with the script execution mechanism. This absence of defense-in-depth means that even if one layer were secured, another remains wide open to injection attacks. The vendor was contacted early regarding this disclosure but failed to respond or provide a patch, leaving users without an official remediation path from the software provider. Consequently, organizations relying on Dromara mayfly-go must implement immediate compensating controls to mitigate risk until a fixed version is released or alternative solutions are adopted.
To mitigate this vulnerability, administrators should immediately restrict network access to the affected service endpoints using firewall rules or reverse proxy configurations that limit exposure to trusted IP addresses only. Implementing strict input validation and output encoding at the application level can help prevent command injection by ensuring that special characters in user-supplied parameters are properly escaped or rejected before reaching the execution layer. Additionally, applying principle of least privilege principles ensures that users do not hold unnecessary permissions such as machine:script:run unless absolutely required for their role. Since no vendor patch is available, deploying a Web Application Firewall with rules specifically targeting command injection patterns may provide an additional layer of protection against exploitation attempts while internal teams work on custom patches or migrate to more secure alternatives.