The vulnerability exists in the RunMachineScript function of the server/internal/machine/api/machine_script.go file in Dromara mayfly-go up to version 1.11.5. Manipulating the argument params leads to OS command injection due to lack of input filtering in the SSH exec layer (Cli.Run). Attackers with the machine:script:run permission and tag access can remotely execute arbitrary commands on affected machines whose templates use {{.param}} placeholders. The exploit is public, requires no admin account, and the vendor has not provided a response or patch.

Successful exploitation allows an attacker with limited privileges (machine:script:run plus tag access) to execute arbitrary OS commands remotely on targeted machines. This can lead to unauthorized command execution and potential compromise of affected systems. The vulnerability has a CVSS 4.0 score of 5.3 (medium severity). No evidence of active exploitation in the wild is reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should restrict the machine:script:run permission and tag access to trusted users only and avoid using templates with {{.param}} placeholders until a fix is available.