What’s Vulnerable › Vulnerabilities
CVE-2026-28801: Natro Macro: Code Injection through Pattern/Path files
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-03-06 · updated 2026-06-17
- Weakness: CWE-94
Description
Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, any ahk code contained inside of a pattern or path file is executed by the macro. Since users commonly share path/pattern files, an attacker could share a file containing malicious code, which is then executed by the program. This code can operate in silence alongside the pattern, running in the background to do whatever the attacker pleases. This issue has been patched in version 1.1.0.
Affected products
- NatroTeam NatroMacro: before 1.1.0 — fixed in 1.1.0
How to fix
Upgrade to a fixed version: NatroTeam NatroMacro 1.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-28801 or the next vulnerability affects your stack