CVE-2026-22208: OpenS100 Portrayal Engine Unrestricted Lua Standard Library Access
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaLopenlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenS100 (S-100 viewer)to a version that resolves this vulnerability.Fixed in commit 753cf29 - Configuration
Modify the Portrayal Engine’s Lua initialization to avoid creating an unrestricted interpreter (remove luaL_openlibs() usage) and sandbox Lua so untrusted portrayal catalogues cannot use standard libraries like 'os' and 'io' to execute commands or access files.
OpenS100 Portrayal Engine (Lua initialization) Lua standard library exposure via luaL_openlibs() = Do not call luaL_openlibs(); use a sandboxed Lua environment with restricted capabilities (no access to libraries such as 'os' and 'io') when loading untrusted portrayal catalogues
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22208?
CVE-2026-22208 has been classified as a critical severity vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-22208?
To fix CVE-2026-22208, update OpenS100 to the latest version after commit 753cf29.
What systems are affected by CVE-2026-22208?
CVE-2026-22208 affects OpenS100 prior to commit 753cf29.
What type of vulnerability is CVE-2026-22208?
CVE-2026-22208 is a remote code execution vulnerability caused by unrestricted Lua standard library access.
Can CVE-2026-22208 be exploited remotely?
Yes, CVE-2026-22208 can be exploited remotely due to the unauthorized access to the Lua interpreter.