Threats tagged 'ghsa-v5gq-hg3h-g4cr'

A security vulnerability (CVE-2026-92992) exists in Dromara mayfly-go up to version 1.11.5 in the AI Assistant component. The flaw involves missing authorization in an unknown function within the file server/internal/ai/api/ai.go. This vulnerability allows remote exploitation and involves a whitelist bypass that lets certain commands run without explicit approval. The issue has been fixed with a silent patch identified by commit 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde.