https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T23:22:16.164132+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-71235 CVE-2026-71235 — Magistrala IoT Platform - Unrestricted Go/Lua Script Execution in Rules Engine 2026-10-01T23:22:16.169043+00:00

Affected: absmach magistrala

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal).