CVE-2026-92992

Dromara mayfly-go (up to 1.11.5 ) contains an authorization flaw in the AI Assistant component (file server/internal/ai/api/ai.go). The whitelist bypass is one-token wide: any compound command containing curl , wget , or sed executes automatically without approval, and that approval is granted by...