Read the docs
TI-2026-69757 Aliases CVE-2026-107780

OS command injection in Dromara Skyeye via textToSpeech format parameter

Priority MEDIUM 52CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection flaw (CWE-78) in the unauthenticated /post/TtsController/textToSpeech endpoint. The format parameter is not sanitized, so a single quote breaks out of a PowerShell string. An unauthenticated remote attacker can run commands as the Skyeye service account on Windows.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02058 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

No affected products listed by the sources yet.

Remediation

The sources list no fixed version for Dromara Skyeye.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Timeline

  1. 2026-10-09 Threatist record created from CVE-2026-107780
  2. 2026-10-13 CISA SSVC decision points changed

References

Other 3

  • TI-2023-28043 HertzBeat AviatorScript Inject RCE CVSS 3.1CRITICAL 9.8
  • TI-2023-24001 An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to… CVSS 3.1CRITICAL 9.8
  • TI-2023-15126 Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. CVSS 3.1CRITICAL 9.8
  • TI-2025-41084 The snailjob component in RuoYi-Vue-Plus versions 5.5.1 and earlier, interface… CVSS 3.1CRITICAL 9.4
  • TI-2026-62126 lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint CVSS 4.0HIGH 8.7
  • TI-2023-28044 HertzBeat SnakeYAML Deser RCE CVSS 3.1CRITICAL 9.8
See all 65 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences