{"id":"CVE-2026-107780","published":"2026-10-08T21:17:52.940","lastModified":"2026-10-13T17:17:17.453","description":"Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/dromara/skyeye","tags":[]},{"url":"https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-promote/skyeye-common/src/main/java/com/skyeye/common/service/impl/TtsServiceImpl.java#L105-L166","tags":[]},{"url":"https://github.com/dromara/skyeye/issues/29","tags":[]},{"url":"https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-os-command-injection-via-texttospeech-format-parameter","tags":[]}],"exploitRefs":[{"url":"https://github.com/dromara/skyeye","tags":[]},{"url":"https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-promote/skyeye-common/src/main/java/com/skyeye/common/service/impl/TtsServiceImpl.java#L105-L166","tags":[]},{"url":"https://github.com/dromara/skyeye/issues/29","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to inject OS commands via the format parameter, leading to potential command execution as the Skyeye service account.","exploitability":"Exploitation is relatively straightforward as it requires only injecting a single quote into the format parameter. The unauthenticated nature of the endpoint makes it accessible to any attacker.","blast_radius":"If exploited, this could result in full compromise of the affected system, including data theft, service disruption, and potential lateral movement within the network.","remediation":"Upgrade to the specific version 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","os-command-injection","unauthenticated","critical"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-09T08:43:14.830Z"}}