CVE-2026-71278

Name of the Vulnerable Software and Affected Versions rust-iot-platform (affected versions not specified)

Description An unauthenticated attacker can achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule. The endpoint 'POST /calc-rule/create' lacks the AuthToken request guard, allowing access without authentication to create a rule containing an arbitrary script field. This stored script is subsequently executed via the quick js::Context::eval() function without sandboxing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Restrict access to the 'POST /calc-rule/create' endpoint to minimize the risk of exploitation.