CVE-2026-92993 is an OS command injection vulnerability in Dromara mayfly-go up to version 1.11.5. The flaw resides in the RunMachineScript function within server/internal/machine/api/machine_script.go, specifically in the handling of the 'params' argument. Attackers with the machine:script:run permission and tag access can remotely execute arbitrary commands on machines whose templates include '{{.param}}' placeholders. The SSH exec layer (Cli.Run) does not filter input, enabling this injection without requiring administrative privileges. The vulnerability is publicly known, but no vendor response or patch has been provided.

Successful exploitation allows remote attackers with limited permissions (machine:script:run plus tag access) to execute arbitrary OS commands on targeted machines. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). The vulnerability does not require admin privileges, increasing the risk for users with these specific permissions. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict the machine:script:run permission and tag access to trusted users only. Monitor for suspicious command execution activity related to machine scripts. Since the vendor has not responded, consider additional network-level controls to limit exposure.