Unauthenticated Attackers Can Run Windows Commands via Dromara Skyeye Flaw
A critical command injection bug in the Dromara Skyeye monitoring tool allows remote attackers to execute arbitrary PowerShell code on Windows servers without a login.
Key points
- The vulnerability, tracked as CVE-2026-107780, carries a CVSS score of 9.3, rated critical.
- Attackers exploit an unauthenticated endpoint to inject single quotes into the format parameter.
- Successful exploitation grants command execution rights as the local Skyeye service account.
Security researchers have identified a severe remote code execution flaw in the open-source monitoring platform Dromara Skyeye. The defect allows unauthorized users to run arbitrary operating system commands on Windows-based servers hosting the application. Because the vulnerable endpoint does not require authentication, the attack surface is exposed to anyone with network access to the service.
In plain English
Dromara Skyeye includes a feature that converts text to speech. This function relies on a specific web address, or endpoint, that accepts input to generate audio. The flaw exists in how the software handles the "format" parameter sent to this endpoint. An attacker can insert a single quote character into this field. This input breaks out of the expected code structure, allowing the attacker to append their own PowerShell commands. The server then executes these commands as if they were legitimate instructions.
The background
The issue is cataloged as CVE-2026-107780 and is classified under CWE-78, which denotes improper neutralization of special elements used in an OS command. The National Vulnerability Database assigns it a CVSS score of 9.3, marking it as critical. The vulnerability affects all versions of Dromara Skyeye up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
When the exploit is triggered, the commands run with the privileges of the Skyeye service account. On Windows systems, service accounts often have elevated permissions necessary for system monitoring and management. This means an attacker could potentially read sensitive files, modify system configurations, or install additional malware. The lack of authentication requirements makes this a high-risk vector for automated scanning and exploitation.
What changes now
Organizations using Dromara Skyeye for infrastructure monitoring must treat this as an urgent priority. The combination of remote accessibility and high privilege escalation potential creates a significant risk to operational integrity. Since the flaw allows for unauthenticated command execution, there is no need for stolen credentials or prior access. Security teams should verify their current deployment status immediately. If the software is in use, isolation from untrusted networks may be necessary until a remediation path is confirmed.
What to do and how to stay safe: Dromara Skyeye
- Inventory all servers running Dromara Skyeye and check the version against commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.
- Restrict network access to the /post/TtsController/textToSpeech endpoint to trusted internal IP addresses only.
- Monitor Windows event logs for unexpected PowerShell execution or process creation by the Skyeye service account.
- Once the vendor provides an update, apply the patch immediately to close the injection vector.
Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-107780?
It is a critical OS command injection vulnerability in Dromara Skyeye that allows unauthenticated remote code execution via the text-to-speech endpoint.
Which versions of Dromara Skyeye are affected?
All versions up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 are vulnerable.
Does an attacker need a password to exploit this?
No, the vulnerable endpoint is unauthenticated, meaning no login credentials are required to trigger the exploit.
