CVE-2026-22208

Katalog CVE

CVSS 9.6 · Critical EPSS 0,96%

Kerentanan Exposed Dangerous Method or Function. Skor CVSS 3.1 9.6 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.

Rincian

Terbit di NVD

17 Februari 2026

Terakhir diubah

14 Juli 2026

Status NVD

Deferred

CVSS 3.1

9.6 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-749: Exposed Dangerous Method or Function
CWE-829: Inclusion of Functionality from Untrusted Control Sphere

EPSS (30 hari)

0,96% peluang dieksploitasi; lebih tinggi dari 60,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/S-100ExpertTeam/OpenS100/commit/753cf294434e8d3961f20a567c4d99151e3b530d
• https://www.mdpi.com/1424-8220/26/4/1246
• https://www.vulncheck.com/advisories/opens100-portrayal-engine-unrestricted-lua-standard-library-access