CVE-2026-22208
- Source
- https://cve.org/CVERecord?id=CVE-2026-22208
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-22208.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-22208
- Published
- 2026-02-17T15:16:22.320Z
- Modified
- 2026-02-20T01:35:25.903665Z
- Severity
-
- 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contain a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
- References