Mayfly Go
Monthly
Authenticated OS command injection in Dromara mayfly-go through version 1.11.5 allows a low-privileged user who holds the machine:script:run permission and tag access to a target machine to execute arbitrary operating-system commands on that machine via the params argument of the RunMachineScript handler. No admin account is required, and publicly available exploit code exists (a public gist referenced in the CVE record), though there is no CISA KEV confirmation of active exploitation. The attack is remote, low complexity, and requires no user interaction, but it is gated by the two authorization grants and by the target machine's script template containing a {{.param}} placeholder where the unsanitized input is substituted before reaching the SSH execution layer.
Authenticated OS command injection in Dromara mayfly-go through version 1.11.5 allows a low-privileged user who holds the machine:script:run permission and tag access to a target machine to execute arbitrary operating-system commands on that machine via the params argument of the RunMachineScript handler. No admin account is required, and publicly available exploit code exists (a public gist referenced in the CVE record), though there is no CISA KEV confirmation of active exploitation. The attack is remote, low complexity, and requires no user interaction, but it is gated by the two authorization grants and by the target machine's script template containing a {{.param}} placeholder where the unsanitized input is substituted before reaching the SSH execution layer.