CVE-2026-71278
CriticalCVSS 9.8Summary
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create containing an arbitrary `script` field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored script is subsequently executed via quick_js::Context::eval() with no sandboxing, allowing an unauthenticated attacker to achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule.
Risk Assessment
Risk of remote code execution in the server process without authentication, potentially leading to full compromise of the IoT platform and associated data.
Recommendation
Add the AuthToken guard to the /calc-rule/create route and apply sandboxing for JavaScript execution. Also review and restrict access to this functionality.
Original NVD description (English source)
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary `script` field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored script is subsequently executed via quick_js::Context::eval() in api/src/biz/calc_run_biz.rs with no sandboxing, allowing an unauthenticated attacker to achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule.