CVE-2026-28801

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28801", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.246Z", "datePublished": "2026-03-06T06:42:13.923Z", "dateUpdated": "2026-03-06T16:05:46.248Z"}, "containers": {"cna": {"title": "Natro Macro: Code Injection through Pattern/Path files", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-c5gm-vfvf-pwhx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-c5gm-vfvf-pwhx"}], "affected": [{"vendor": "NatroTeam", "product": "NatroMacro", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T06:42:13.923Z"}, "descriptions": [{"lang": "en", "value": "Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which is then executed by the program. This code can operate in silence alongside the pattern, running in the background to do whatever the attacker pleases. This issue has been patched in version 1.1.0."}], "source": {"advisory": "GHSA-c5gm-vfvf-pwhx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T15:58:09.441074Z", "id": "CVE-2026-28801", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T16:05:46.248Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28801", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-03T14:25:19.246Z", "datePublished": "2026-03-06T06:42:13.923Z", "dateUpdated": "2026-03-06T16:05:46.248Z"}, "containers": {"cna": {"title": "Natro Macro: Code Injection through Pattern/Path files", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-c5gm-vfvf-pwhx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-c5gm-vfvf-pwhx"}], "affected": [{"vendor": "NatroTeam", "product": "NatroMacro", "versions": [{"version": "< 1.1.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-06T06:42:13.923Z"}, "descriptions": [{"lang": "en", "value": "Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which is then executed by the program. This code can operate in silence alongside the pattern, running in the background to do whatever the attacker pleases. This issue has been patched in version 1.1.0."}], "source": {"advisory": "GHSA-c5gm-vfvf-pwhx", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28801", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T15:58:09.441074Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T15:58:10.432Z"}}]}}

{"affected": [{"affectedData": [{"product": "NatroMacro", "vendor": "NatroTeam", "versions": [{"status": "affected", "version": "< 1.1.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:natroteam:natro_macro:*:*:*:*:*:*:*:*", "matchCriteriaId": "D82B08C5-1B84-4F2F-82F7-32C5DF3DC40D", "versionEndExcluding": "1.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which is then executed by the program. This code can operate in silence alongside the pattern, running in the background to do whatever the attacker pleases. This issue has been patched in version 1.1.0."}, {"lang": "es", "value": "Natro Macro es un macro de c\u00f3digo abierto para Bee Swarm Simulator escrito en AutoHotkey. Antes de la versi\u00f3n 1.1.0, cualquier c\u00f3digo ahk contenido dentro de un archivo de patr\u00f3n o ruta es ejecutado por el macro. Dado que los usuarios suelen compartir archivos de ruta/patr\u00f3n, un atacante podr\u00eda compartir un archivo que contiene c\u00f3digo malicioso, el cual es luego ejecutado por el programa. Este c\u00f3digo puede operar en silencio junto con el patr\u00f3n, ejecut\u00e1ndose en segundo plano para hacer lo que el atacante desee. Este problema ha sido parcheado en la versi\u00f3n 1.1.0."}], "id": "CVE-2026-28801", "lastModified": "2026-06-17T10:29:04.150", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28801", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T15:58:09.441074Z", "version": "2.0.3"}}]}, "published": "2026-03-06T07:16:00.883", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/NatroTeam/NatroMacro/security/advisories/GHSA-c5gm-vfvf-pwhx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "NatroMacro", "source": "cna", "vendor": "NatroTeam"}, "product": "natromacro", "vendor": "natroteam"}], "analysis": {"en": {"generated_at": "2026-04-16T11:30:55.021596+00:00", "value": {"mitigation_remediation": ["Update NatroMacro to version 1.1.0 or later to eliminate the code\u2011injection flaw.", "Avoid loading pattern or path files from untrusted or unknown sources; only use files from verified origins.", "If an update cannot be applied immediately, disable the macro\u2019s automatic execution of embedded AHK code by removing or sanitizing script sections within pattern/path files."], "summary": {"action": "Immediate Patch", "impact": "Code Injection allowing arbitrary code execution within a user\u2019s system"}, "threat_synthesis": {"affected_systems": "All installations of NatroTeam NatroMacro running a version earlier than 1.1.0 that permit automatic loading of pattern and path files from shared locations. The known affected vendor/product combination is NatroTeam NatroMacro, as documented by the CNA, with the affected version range spanning all releases before 1.1.0.", "description_and_impact": "NatroMacro, an open\u2011source AutoHotkey macro for Bee Swarm Simulator, executed any AHK code embedded in pattern or path files prior to version 1.1.0. A malicious actor can craft a shared file that contains executable code; when the macro loads the file, the code runs silently in the background, enabling the attacker to perform any action the macro has permission to execute. This vulnerability is a classic instance of code injection and its impact enables full control of the host system, compromising confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS base score of 6.6 indicates moderate severity, and the EPSS score of less than 1% suggests low exploitation likelihood under current conditions. The vulnerability is not listed in CISA\u2019s KEV catalog, implying no publicly confirmed, large\u2011scale exploitation. Exploitation requires a user to run NatroMacro with an untrusted pattern or path file; once executed, the macro has full access to the user\u2019s machine. Consequently the risk is elevated for environments where users regularly share or ingest such files, and mitigation actions should be prioritized to avoid potential compromise."}}}}, "created": "2026-03-09T10:08:26.605500+00:00", "updated": "2026-04-16T11:45:26.258745+00:00", "vendors": ["natroteam", "natroteam$PRODUCT$natromacro"]}