Key points
- CVE-2026-107780 is rated Critical with a CVSS score of 9.3.
- The vulnerability exists in the unauthenticated /post/TtsController/textToSpeech endpoint.
- Attackers can execute commands as the Skyeye service account on Windows systems.
Developers using Dromara Skyeye must address a severe security flaw that allows remote attackers to execute arbitrary operating system commands. The vulnerability, tracked as CVE-2026-107780, carries a Critical severity rating of 9.3 on the Common Vulnerability Scoring System. It affects versions of the software up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
The issue stems from improper input validation in the text-to-speech functionality. Because the affected endpoint is unauthenticated, attackers do not need valid credentials to exploit it. This makes the vulnerability easily discoverable by automated scanning tools and significantly increases the risk of widespread exploitation.
What we know
The flaw is classified as an OS command injection vulnerability, mapped to CWE-78. It resides specifically within the `format` parameter of the `/post/TtsController/textToSpeech` endpoint. According to the National Vulnerability Database record, an attacker can inject a single quote character into this parameter. This injection breaks out of the existing PowerShell string context.
Once the string context is broken, the attacker can append and execute malicious PowerShell commands. These commands run with the privileges of the Skyeye service account on Windows operating systems. This level of access can allow an attacker to read sensitive files, modify system configurations, or pivot to other parts of the network. The vulnerability is present in all versions of Dromara Skyeye leading up to the specified commit hash.
Defender's checklist
- Identify all instances of Dromara Skyeye running in your environment.
- Verify the current version or commit hash against the affected range.
- Check if the `/post/TtsController/textToSpeech` endpoint is accessible from the internet or untrusted networks.
- Review access logs for unusual activity on the TTS endpoint prior to patching.
What to do and how to stay safe: Dromara Skyeye
- Audit your network perimeter to ensure the Skyeye TTS endpoint is not exposed to the public internet.
- Implement strict input validation rules on web application firewalls to block single quotes and other shell metacharacters in the `format` parameter.
- Monitor system logs for unexpected PowerShell executions or new processes spawned by the Skyeye service account.
- Plan to update to the patched version once the vendor provides an official release or commit confirmation.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107780?
The CVSS score is 9.3, which is rated as Critical.
Does an attacker need a login to exploit this vulnerability?
No, the vulnerable endpoint is unauthenticated, so no credentials are required.
Which operating systems are affected by this command injection?
The vulnerability allows command execution on Windows systems running the Skyeye service.
