CVE-2026-71278: rust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script Evaluation
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calcrulerouter.rs) containing an arbitrary script field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored script is subsequently executed via quickjs::Context::eval() in api/src/biz/calcrunbiz.rs with no sandboxing, allowing an unauthenticated attacker to achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71278?
The severity of CVE-2026-71278 is critical with a score of 9.8.
How do I fix CVE-2026-71278?
To fix CVE-2026-71278, implement proper authentication for the POST /calc-rule/create endpoint and validate the script field to prevent remote code execution.
What are the potential impacts of CVE-2026-71278?
CVE-2026-71278 can lead to unauthenticated remote code execution, allowing an attacker to execute arbitrary code on the server.
Who is affected by CVE-2026-71278?
Users of the rust-iot-platform that expose the vulnerable endpoint without proper authentication are affected by CVE-2026-71278.
What type of vulnerability is CVE-2026-71278 categorized as?
CVE-2026-71278 is categorized as a Code Injection vulnerability.