Live › vulnerability › CVE-2026-62853
ThingLinks, an enterprise IoT platform, passes user-supplied Groovy script content to an unsandboxed compile-and-load step on the rule engine's script test and register endpoint. An authenticated attacker can run arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Teams running ThingLinks versions before 1.4.0 that expose the rule engine's Groovy script test and register endpoint. The sources do not say whether the flaw is reachable by default or only with specific features enabled. Installations already on 1.4.0 or later are not affected.
No product ranges from the sources yet.
1.4.0./groovyScriptTest/registerScript endpoint is reachable from outside your network.1.4.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the rule engine's Groovy script test/register flow. This issue is fixed in version 1.4.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-62853")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.