CVE-2026-107780

{
  "etk_id": "ETK-2026-1007",
  "cve_id": "CVE-2026-107780",
  "display_id": "CVE-2026-107780",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-95258",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated OS command injection in Dromara Skyeye",
  "summary": "Affected Dromara Skyeye versions expose an unauthenticated command-injection issue in the text-to-speech endpoint. An unauthenticated remote attacker may execute commands as the Skyeye service account on Windows systems where that endpoint is reachable.",
  "mitigation": "Restrict access to the text-to-speech endpoint to trusted users and networks immediately, and do not expose it publicly. Run the Skyeye service with minimal privileges and monitor for an upstream fixed release, as no fixed version is recorded.",
  "vendor": "dromara",
  "product": "skyeye",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 003549ae5615bd114ba5bb8ddf6a8e8ead97c321"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "skyeye",
      "purl": null
    }
  ],
  "cwes": [
    78
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
  "epss_score": 0.0206,
  "epss_percentile": 0.8103,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 33.242132233333336,
  "t0_at": "2026-10-08T20:15:55.304000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T20:15:55.304000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T20:15:55.304000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-107780"
    }
  }
}