CVE-2026-62853

CriticalCVSS 9.9

Published: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Summary

In ThingLinks before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed compilation and loading flow. An authenticated attacker can supply code that is compiled and executed on the server, leading to remote server-side code execution. The issue affects the rule engine's Groovy script test/register flow and is fixed in version 1.4.0.

Risk Assessment

An authenticated user can execute arbitrary code on the server, taking control of the IoT platform and potentially connected devices. This can lead to a full compromise of confidentiality, integrity, and availability.

Recommendation

Update ThingLinks to version 1.4.0 or later. Restrict access to the /groovyScriptTest/registerScript endpoint to trusted administrators.

Other vulnerabilities in ThingLinks

CVE-2026-62849Critical
In ThingLinks before 1.4.0, an unauthenticated SQL injection vulnerability exists in the TDengine TDS APIs. JSON field values submitted to /anyUser/tds/insertTableData reach unsafe SQL construction in the TDS mapper, allowing a remote unauthenticated attacker to tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The issue is fixed in version 1.4.0.

Original NVD description (English source)

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS