Guyuelanmin

**Name of the Vulnerable Software and Affected Versions** Dromara mayfly-go versions prior to 1.11.6 **Description** A missing authorization issue exists within the AI Assistant component, specifically in the `server/internal/ai/api/ai.go` file. This flaw allows for remote exploitation via a whitelist bypass that is one-token wide. Consequently, compound commands containing `curl`, `wget`, or `sed` can be executed automatically without required approval, as the system grants self-approval to the session user. **Recommendations** Apply the patch identified by 74bcb926eb4f5f94e7681144d7bf2168a0ec7cde for versions prior to 1.11.6.

**Name of the Vulnerable Software and Affected Versions** mayfly-go versions prior to 1.11.6 **Description** An OS command injection flaw exists in the Machine Script Feature within the `RunMachineScript()` function located in the `server/internal/machine/api/machine script.go` file. A remote attacker with `machine:script:run` and tag access can execute arbitrary commands on machines that use templates containing `{{.param}}` placeholders by manipulating the `params` argument. Additionally, the SSH exec layer `Cli.Run()` does not perform input filtering for any caller. **Recommendations** Update mayfly-go to a version newer than 1.11.5. As a temporary mitigation, restrict access to the `RunMachineScript()` function and avoid using `{{.param}}` placeholders in machine templates.