CVE-2026-71235 — Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine

CVE-2026-71235

Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine PUBLISHED

Description (CNA)

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).

Affected (CNA)

Vendor / product	Versions
absmach / magistrala	affected 0

CWE

CWE-94

References

https://github.com/absmach/magistrala

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.