{"id":"CVE-2026-62853","published":"2026-10-30T21:17:14.267","lastModified":"2026-10-30T21:17:14.267","description":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-78","CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3","tags":[]},{"url":"https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v","tags":[]}],"exploitRefs":[{"url":"https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3","tags":[]},{"url":"https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0","tags":[]},{"url":"https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v","tags":[]}],"hasPoc":true,"ai":{"summary":"The ThingLinks IoT platform's `/groovyScriptTest/registerScript` endpoint allows authenticated users to submit Groovy scripts that are compiled and executed unsandboxed on the server, leading to remote code execution (RCE) due to lack of input sanitization and sandboxing.","exploitability":"Exploitation requires valid authentication but no additional privileges or user interaction; it is straightforward for an authenticated attacker.","blast_radius":"Successful exploitation grants full server compromise, enabling data theft, system manipulation, and lateral movement within the IoT infrastructure.","remediation":"Upgrade to ThingLinks version 1.4.0 or later, which patches the vulnerability by sandboxing Groovy script execution.","detection":"Monitor for requests to `/groovyScriptTest/registerScript` containing Groovy syntax (e.g., `import`, `new`, class definitions) in POST bodies; such activity is anomalous for a test endpoint and may indicate exploitation attempts.","tags":["rce","groovy","unsandboxed-execution","iot-platform","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-31T08:45:35.811Z"}}