{"id":"CVE-2026-62853","kind":"vulnerability","aliases":["CVE-2026-62853"],"related":[],"title":"ThingLinks IoT platform: authenticated users can run server code","description":"ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.","summary":"ThingLinks, an enterprise IoT platform, passes user-supplied Groovy script content to an unsandboxed compile-and-load step on the rule engine's script test and register endpoint. An authenticated attacker can run arbitrary code on the server.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["groovy","iot","other","rule-engine","thinglinks"],"not_affected_if":["version-1.4.0-or-later"],"how_to_check":"- Check the installed ThingLinks version; affected builds are those before `1.4.0`.\n- Confirm whether the `/groovyScriptTest/registerScript` endpoint is reachable from outside your network.","fix":"- Move to ThingLinks `1.4.0` or later.","status":"open","published_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","triaged_at":"2026-10-30T21:26:27+00:00","updated_at":"2026-10-30T21:26:27+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-30T21:26:27Z","model":"claude-haiku-5-5","output":{"fix":"- Move to ThingLinks `1.4.0` or later.","reach":"network","title":"ThingLinks IoT platform: authenticated users can run server code","impact":"high","summary":"ThingLinks, an enterprise IoT platform, passes user-supplied Groovy script content to an unsandboxed compile-and-load step on the rule engine's script test and register endpoint. An authenticated attacker can run arbitrary code on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["thinglinks","iot","rule-engine","groovy"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs on the server with the application's privileges","analyst_note":"Check whether the rule engine's Groovy script endpoint is enabled in default configurations and which roles can reach it; the NVD entry is the only source.","how_to_check":"- Check the installed ThingLinks version; affected builds are those before `1.4.0`.\n- Confirm whether the `/groovyScriptTest/registerScript` endpoint is reachable from outside your network.","plain_action":"","needs_analyst":true,"not_affected_if":["version-1.4.0-or-later"],"who_is_affected":"Teams running ThingLinks versions before 1.4.0 that expose the rule engine's Groovy script test and register endpoint. The sources do not say whether the flaw is reachable by default or only with specific features enabled. Installations already on 1.4.0 or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000695,"input_tokens":4179,"output_tokens":554,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62853':12A,15A '/groovyscripttest/registerscript':73C '1.4.0':71C,132C 'accept':75C 'affect':117C 'arbitrari':58B,109C 'attack':55B,95C 'authent':4A,54B,94C 'code':9A,59B,98C,113C 'compil':39B,89C,101C 'compile-and-load':38B 'content':34B,81C 'cve':10A,13A 'endpoint':52B,74C 'engin':21B,46B,120C 'enterpris':25B,66C 'execut':114C 'fix':129C 'flow':92C,125C 'groovi':16B,32B,79C,88C,122C 'instanti':103C 'iot':2A,17B,26B,67C 'issu':116C,127C 'load':41B,91C 'pass':28B,83C 'platform':3A,27B,68C 'prior':69C 'provid':97C 'regist':51B 'result':107C 'rule':20B,45B,119C 'rule-engin':19B 'run':7A,57B 'script':33B,48B,80C,123C 'server':8A,62B,106C,111C 'server-sid':110C 'side':112C 'step':42B 'suppli':31B,78C 'test':49B 'test/register':124C 'thinglink':1A,22B,23B,63C 'unsandbox':37B,87C 'user':5A,30B,77C 'user-suppli':29B,76C 'version':131C","nicknames":[],"mitigations":[],"who_affected":"Teams running ThingLinks versions before 1.4.0 that expose the rule engine's Groovy script test and register endpoint. The sources do not say whether the flaw is reachable by default or only with specific features enabled. Installations already on 1.4.0 or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T21:17:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62853","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62853","severity":null,"published_at":"2026-10-30T21:17:14+00:00","modified_at":"2026-10-30T21:17:14+00:00","first_seen_at":"2026-10-30T21:25:53+00:00","fetched_at":"2026-10-30T21:25:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}