CVE-2026-62853
ThingLinks is an enterprise IoT platform
- Risk score
- 59/100
- CVSS
- 9.9 v3.1
- Published
- 30 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed Groovy compilation and loading flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting …
- Affected
- See advisory
- Fix
- Upgrade the product to 1.4.0 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 9.9 critical
References
Original description
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.
Last activity 30 Oct 2026. Patch Forecast updates every hour.