CVE-2026-92993

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92993
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92993.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92993
Published
2026-09-17T19:15:15Z
Modified
2026-09-18T03:49:04Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection
Details

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machine_script.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The attack can be executed remotely. The exploit is now public and may be used. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. The vendor was contacted early about this disclosure but did not respond in any way.

Database specific 
{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-77",
        "CWE-78"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92993.json"
}
References

Affected packages

Git / github.com/dromara/mayfly-go

Affected ranges

Type
GIT
Repo
https://github.com/dromara/mayfly-go
Events
Introduced
847f5c7c907db310e31be5c2ed2b79d2beeff2ad
Last Affected
f81d2f9015e7f6bb65b73fa36ce303150d4d3aa6
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.11.0"
        },
        {
            "last_affected": "1.11.0"
        },
        {
            "introduced": "1.11.1"
        },
        {
            "last_affected": "1.11.1"
        },
        {
            "introduced": "1.11.2"
        },
        {
            "last_affected": "1.11.2"
        },
        {
            "introduced": "1.11.3"
        },
        {
            "last_affected": "1.11.3"
        },
        {
            "introduced": "1.11.4"
        },
        {
            "last_affected": "1.11.4"
        },
        {
            "introduced": "1.11.5"
        },
        {
            "last_affected": "1.11.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

1.*
1.11.0
1.11.1
1.11.2
1.11.3
1.11.4
1.11.5
v1.*
v1.11.0
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.11.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92993.json"