What is CVE-2026-28800?

CVE-2026-28800 is a medium-severity vulnerability in Natroteam Natro Macro, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-03-06.

How severe is CVE-2026-28800?

Medium severity. CVSS v3 base score is 6.4 out of 10.

Auth bypass in Natroteam Natro Macro

CVE-2026-28800

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. This includes keyboard and mouse inputs and full file access. This issue has been patched in version 1.1.0.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.002 (11.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H.

Affected products

Natroteam Natro_macro
Natroteam Natromacro — versions < 1.1.0

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-28800?: CVE-2026-28800 is a medium-severity vulnerability in Natroteam Natro Macro, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-03-06.
How severe is CVE-2026-28800?: Medium severity. CVSS v3 base score is 6.4 out of 10.