CVE-2026-22208
CriticalCVSS 9.6Exploitation Probability (EPSS)
Elevated risk56th percentile - higher than 56% of all known CVEs
Summary
OpenS100 prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing, exposing standard libraries 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue with Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
Risk Assessment
The risk for the organization includes full system compromise by an attacker who can execute arbitrary commands, access data, install malware, or disrupt services. The vulnerability can be exploited remotely without authentication.
Recommendation
Immediately update OpenS100 to a version containing commit 753cf29 or later. If an update is not possible, restrict importing S-100 portrayal catalogues to trusted sources only and implement sandboxing for the Lua interpreter.
Original NVD description (English source)
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.