CVE-2026-28800CWE-22CWE-287CWE-434

Natro Macro: Malicious actions allowed through Discord RC Commands by any user

Medium · published March 6, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
28.4
In the wild
Unconfirmed
What it is

Natro Macro is an open-source Bee Swarm Simulator macro written in AutoHotkey. Prior to version 1.1.0, anyone with Discord Remote Control set up in a non-private channel gives access to any user with the permission to send message in said channel access to do anything on their computer. This includes keyboard and mouse inputs and full file access. This issue has been patched in version 1.1.0.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00359 · 28.4th percentile
Weaknesses
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'); CWE-287 · Improper Authentication; CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-03-06T06:42Z
EPSS history
Timeline
  • 06 MAR 06:42Z
    Natro Macro: Malicious actions allowed through Discord RC Commands by any user
    cvelistv5