CVE-2026-92993

Name of the Vulnerable Software and Affected Versions mayfly-go versions prior to 1.11.6

Description An OS command injection flaw exists in the Machine Script Feature within the RunMachineScript() function located in the server/internal/machine/api/machine script.go file. A remote attacker with machine:script:run and tag access can execute arbitrary commands on machines that use templates containing {{.param}} placeholders by manipulating the params argument. Additionally, the SSH exec layer Cli.Run() does not perform input filtering for any caller.

Recommendations Update mayfly-go to a version newer than 1.11.5. As a temporary mitigation, restrict access to the RunMachineScript() function and avoid using {{.param}} placeholders in machine templates.