CVE-2026-107780 Details

An OS command injection vulnerability has been identified in Dromara Skyeye, specifically in the 'textToSpeech' endpoint of the TTS Controller. This vulnerability exists in the default branch, in commit '003549ae5615bd114ba5bb8ddf6a8e8ead97c321'. The issue arises from the 'format' parameter, which is not properly sanitized, allowing attackers to inject a single quote to escape the PowerShell string and execute commands as the Skyeye service account on Windows. The vulnerability is present in several components of the application, including 'skyeye-adm', 'skyeye-auto', 'skyeye-crm', 'skyeye-doc', 'skyeye-erp', 'skyeye-promote', 'skyeye-seal-service', 'skyeye-shop', 'skyeye-tms', 'skyeye-wall', 'skyeye-zuul', and 'xxl-job-2.3.0'.

It is recommended to update the 'textToSpeech' endpoint to include an allowlist for the 'format' parameter, restricting it to specific audio formats such as WAV and MP3. Additionally, the endpoint should be modified to use 'ProcessBuilder' for executing commands, which provides better control over command execution and prevents injection attacks.