Dromara Skyeye: Unauthenticated OS command injection in textToSpeech endpoint

Summary

Dromara Skyeye contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint, triggered via the format parameter. An attacker who can reach the application over the network can inject a single quote to break out of a PowerShell string and execute commands as the Skyeye service account on Windows. No authentication or user interaction is required, and the CVSS 4.0 score is 9.3 (critical). No fix is published yet.

Affected

• Dromara Skyeye, all versions up to and including commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321
• Platform: Windows (PowerShell-based text-to-speech code path)
• No release version numbers are given in the sources.

Fixed in

Unknown. No fixed commit, release or vendor security advisory was found at the time of writing.

Workaround

• No vendor mitigation is documented.
• Remove Skyeye from internet exposure or restrict access to trusted networks or VPN only.
• Block the affected endpoint path at a reverse proxy or WAF as a temporary measure and verify that the block works. This does not fix the code.
• Run the application under a low-privilege service account.

Exploitation

• Known exploited (KEV): no listing found.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• EPSS: 0.02058 (calculated shortly after publication).
• Public technical details of the vulnerable code path exist in GitHub issue #29. No confirmed public exploit was found.

Our recommendation

• Inventory all Skyeye instances, including test and development systems, across servers and cloud VMs.
• If an instance is reachable from the internet, take it offline or restrict it to VPN or allowlisted addresses now.
• Review web logs for requests to the TTS endpoint since 2026-10-07 and check for PowerShell processes spawned by the Skyeye Java process.
• If compromise is suspected, rotate the service account credentials and treat the host as compromised.
• Monitor GitHub issue #29 and the Skyeye repository for a fix; do not assume one exists until it is published.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CVE-2026-107780 Vulnerability Record (VulnCheck advisory) www.vulncheck.com
• Dromara Skyeye GitHub repository github.com
• Vulnerable code: TtsServiceImpl.java github.com
• Skyeye GitHub issue #29 github.com
• OSV entry CVE-2026-107780 osv.dev
• VulDB CVE-2026-107780 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 02:54.