Critical OS Command Injection Found in Dromara Skyeye TTS Endpoint

Dromara Skyeye contains a critical OS command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands on Windows servers. The flaw, tracked as CVE-2026-107780, affects versions of the software up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321.

The vulnerability resides in the /post/TtsController/textToSpeech endpoint. According to the National Vulnerability Database (NVD), attackers can exploit the "format" parameter by injecting a single quote. This input breaks out of the PowerShell string context, allowing the execution of system commands. Because the endpoint is unauthenticated, remote adversaries do not need valid credentials to trigger the exploit. Successful exploitation grants the attacker the privileges of the Skyeye service account on the affected Windows host. The issue is classified under CWE-78, indicating improper neutralization of special elements used in an OS command.

Technical Context and Severity

The National Vulnerability Database assigns CVE-2026-107780 a CVSS score of 9.3, which falls into the Critical severity range. This high score reflects the ease with which the vulnerability can be exploited and the significant impact on system integrity and confidentiality. The attack vector is network-based, meaning it can be triggered from the internet without prior access to the application.

The mechanism involves breaking out of a PowerShell string. By manipulating the format parameter, an attacker can terminate the expected string and append malicious PowerShell code. This allows for remote code execution (RCE) with the privileges of the service running the Skyeye application. There is no mention in the source material of a patch or fix being available at this time.

Affected Systems and Scope

The vulnerability affects Dromara Skyeye versions leading up to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. Organizations using this specific version or earlier builds of the software on Windows platforms are at risk. The impact is specific to Windows environments because the exploit relies on PowerShell string manipulation. Linux or other Unix-like systems running Skyeye may not be affected by this specific injection vector, though the source material does not explicitly confirm the status of non-Windows deployments.

The lack of authentication requirements for the /post/TtsController/textToSpeech endpoint significantly widens the attack surface. Any system exposing this endpoint to the internet or an untrusted network is potentially vulnerable to automated scanning and exploitation.

What should you do?

Organizations should immediately verify if they are running Dromara Skyeye versions prior to commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321. If the software is in use, administrators should restrict network access to the /post/TtsController/textToSpeech endpoint using firewalls or web application firewalls (WAFs) to block unauthorized traffic. Monitor logs for unusual PowerShell activity or unexpected outbound connections from the Skyeye service account. Once the vendor provides an update, apply the patch promptly.