Platform
windows
Component
natromacro
Fixed in
1.1.1
CVE-2026-28801 affects NatroMacro, an open-source macro tool for Bee Swarm Simulator. This vulnerability allows an attacker to inject and execute malicious code through shared pattern or path files, potentially leading to unauthorized actions within the application. Versions of NatroMacro prior to 1.1.0 are vulnerable, and a patch is available in version 1.1.0.
The primary impact of CVE-2026-28801 is the ability for an attacker to execute arbitrary code on a victim's system. Because NatroMacro users frequently share pattern and path files, a malicious actor can craft a file containing harmful AutoHotkey code and distribute it to unsuspecting users. Upon opening or using the compromised file within NatroMacro, the embedded code will execute silently in the background. This could lead to data theft, system manipulation, or even remote control of the affected machine. The blast radius extends to anyone using vulnerable versions of NatroMacro and sharing files with others.
This vulnerability was publicly disclosed on 2026-03-06. There are currently no known public exploits or active campaigns targeting CVE-2026-28801. It is not listed on the CISA KEV catalog. The ease of exploitation stems from the common practice of sharing files among NatroMacro users, making it a potentially attractive target for opportunistic attackers.
Exploit Status
EPSS
0.02% (5% percentile)
CISA SSVC
CVSS Vector
The definitive mitigation for CVE-2026-28801 is to upgrade NatroMacro to version 1.1.0 or later. If upgrading is not immediately feasible, exercise extreme caution when opening or using pattern or path files from untrusted sources. Consider implementing a review process for shared files to scan for potentially malicious AutoHotkey code. While a direct WAF rule is not applicable, monitoring for unusual process activity associated with NatroMacro can provide an early warning. After upgrading, confirm the fix by attempting to execute a known malicious pattern file – it should no longer trigger code execution.
Update NatroMacro to version 1.1.0 or higher. This version fixes the code injection vulnerability by preventing the execution of malicious AutoHotkey code contained in shared pattern or path files.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-28801 is a medium-severity vulnerability in NatroMacro versions up to 1.1.0 that allows malicious code to be executed from shared pattern/path files, potentially leading to unauthorized actions.
You are affected if you are using NatroMacro version 1.1.0 or earlier and share pattern or path files with other users.
Upgrade NatroMacro to version 1.1.0 or later to resolve this vulnerability. Exercise caution when opening files from untrusted sources until the upgrade is complete.
As of now, there are no known public exploits or active campaigns targeting CVE-2026-28801, but caution is advised.
Refer to the NatroMacro project's official repository or website for the latest advisory and release notes regarding CVE-2026-28801.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.