Critical severity · published Oct 8, 2026
CVE-2026-107780
Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter
9.8
CVSS
2.1%
EPSS
No
On KEV
Description
Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.1% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SK
skyeye · dromara
through 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-107780
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-107780
issue-tracking
https://github.com/dromara/skyeye/issues/29
technical-description
https://github.com/dromara/skyeye/blob/003549ae5615bd114ba5bb8ddf6a8e8ead97c321/skyeye-promote/skyeye-common/src/main/java/com/skyeye/common/service/impl/TtsServiceImpl.java#L105-L166
product
https://github.com/dromara/skyeye
third-party-advisory
https://www.vulncheck.com/advisories/dromara-skyeye-unauthenticated-os-command-injection-via-texttospeech-format-parameter
More from skyeye
9.8
CVE-2026-107779
Dromara Skyeye xxl-job-admin Missing Authentication on Job Endpoints Allows RCE
7.4
CVE-2026-107781
Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById
6.5
CVE-2026-110609
Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter