Dromara mayfly-go CVE-2026-92993

Requires an authenticated account (PR:L) holding the machine:script:run permission AND tag access to at least one target machine - no admin account is needed. The injectable path additionally requires that the target machine's script template contains a {{.param}} placeholder, which is where the unsanitized 'params' argument is substituted before reaching the SSH exec layer (Cli.Run applies no input filtering). Exploitation is remote over the network with low complexity and no user interaction. The limiting factors are the two authorization grants (machine:script:run plus tag scope) and the template-placeholder configuration; a deployment where no accessible template uses {{.param}} is not reachable via this specific vector, though the note that Cli.Run filters no caller input suggests related exposure.

This is an authenticated OS command injection (CWE-78) with a publicly available exploit, which elevates it above a purely theoretical finding. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L, score 5.3, E:P) rates the technical impact as only Low across confidentiality/integrity/availability - yet the description explicitly states the flaw yields 'arbitrary command execution on machines,' which is a high-impact primitive. This is a notable internal conflict: a genuine RCE-class outcome scored with Low impact metrics under-rates the real severity; my independent assessment lands at CVSS 3.1 ~8.8. Mitigating the risk are concrete gates: the attacker must already hold an account with the machine:script:run permission plus tag access to a target, and the target machine's script template must contain a {{.param}} placeholder for the injection to reach the SSH exec layer. The E:P (Proof-of-Concept) maturity in the vector is consistent with the public gist exploit but does NOT indicate active exploitation - this is not in CISA KEV and no EPSS score is provided. Net: a real, patch-worthy priority for anyone running mayfly-go with multiple lower-trust operator accounts, but the authentication and template-configuration prerequisites keep it from being a wormable/unauthenticated internet-scale threat.

A low-privilege mayfly-go operator who has been granted the machine:script:run permission and tag access to a fleet host crafts a script-run request whose 'params' argument embeds shell metacharacters. When the server substitutes the value into a template containing a {{.param}} placeholder and hands it to the SSH exec layer (Cli.Run), the injected commands execute on the managed machine with the SSH user's privileges. A public proof-of-concept exploit is available as a GitHub gist, lowering the skill barrier to reproduce it.