CVE-2026-92993 Dromara CVE debrief

Who should care

Defenders responsible for Dromara mayfly-go deployments, especially those using machine script features with remote access and tag-based permissions, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-92993 is a vulnerability in Dromara mayfly-go up to 1.11.5 that allows for OS command injection through the RunMachineScript function. Defenders should prioritize verifying affected versions, assessing exposure of machine script features, and implementing input validation and filtering to prevent potential attacks.

• Remote code execution on machines with specific templates and access permissions.
• Potential for attackers to execute arbitrary commands without admin account.
• Exposure of machine script features to unauthorized users.
• Need for input validation and filtering in the RunMachineScript function.

Technical summary

The vulnerability is located in the RunMachineScript function of the machine_script.go file in Dromara mayfly-go up to 1.11.5. An attacker can execute arbitrary commands on machines with specific templates and access permissions. The manipulation of the argument params results in os command injection. The attack can be executed remotely. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller.

Defensive priority

Defenders should prioritize verifying the presence of affected versions and assessing exposure of machine script features, especially where remote access and tag-based permissions are involved.

Recommended defensive actions

• Verify the presence of affected Dromara mayfly-go versions up to 1.11.5 in your environment.
• Assess exposure of machine script features, especially where remote access and tag-based permissions are involved.
• Restrict access to machine script features to only necessary personnel.
• Implement input validation and filtering for the RunMachineScript function.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Dromara mayfly-go up to 1.11.5, including the affected component and potential attack vectors. The vulnerability is located in the RunMachineScript function of the machine_script.go file. Exploitation needs no admin account. Any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders; the SSH exec layer (Cli.Run) also applies no input filtering to any caller. Defenders should 1

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.