CVE-2026-71278

rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/iot-ecology/rust-iot-platform

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) rust-IoT-platform permite crear una ’regla de cálculo’ vía POST /calc-rule/create (API/src/controller/calc_rule_router.rs) que contiene un campo ’script’ arbitrario. Esta ruta no utiliza el guard de solicitud AuthToken usado en otras partes de la aplicación, haciéndola accesible sin autenticación. El script almacenado se ejecuta posteriormente vía quick_js::Context::eval() en API/src/biz/calc_run_biz.rs sin sandboxing, permitiendo a un atacante no autenticado lograr la ejecución arbitraria de JavaScript en el proceso del servidor al crear y activar una ’regla de cálculo’ maliciosa.

Information

Published : 2026-08-05 13:24

Updated : 2026-10-23 21:10

NVD link : CVE-2026-71278

Mitre link : CVE-2026-71278

CVE.ORG link : CVE-2026-71278

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-71278", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71278", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-05T15:57:06.656815Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "iot-ecology", "product": "rust-iot-platform", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "programFiles": ["api/src/controller/calc_rule_router.rs", "api/src/biz/calc_run_biz.rs"], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T13:24:52.320", "references": [{"url": "https://github.com/iot-ecology/rust-iot-platform", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication."}, {"lang": "es", "value": "rust-IoT-platform permite crear una \u2019regla de c\u00e1lculo\u2019 v\u00eda POST /calc-rule/create (API/src/controller/calc_rule_router.rs) que contiene un campo \u2019script\u2019 arbitrario. Esta ruta no utiliza el guard de solicitud AuthToken usado en otras partes de la aplicaci\u00f3n, haci\u00e9ndola accesible sin autenticaci\u00f3n. El script almacenado se ejecuta posteriormente v\u00eda quick_js::Context::eval() en API/src/biz/calc_run_biz.rs sin sandboxing, permitiendo a un atacante no autenticado lograr la ejecuci\u00f3n arbitraria de JavaScript en el proceso del servidor al crear y activar una \u2019regla de c\u00e1lculo\u2019 maliciosa."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}