Remote Code Execution Vulnerability in OpenS100 by S-100 Expert Team

CVE-2026-22208

What is CVE-2026-22208?

OpenS100, the reference implementation of the S-100 viewer, contains a vulnerability that allows for remote code execution due to an unrestricted Lua interpreter. The Portrayal Engine initializes Lua without proper sandboxing, exposing critical libraries to potential exploitation. This flaw permits attackers to craft malicious S-100 portrayal catalogues that, when imported by users, execute arbitrary Lua scripts with the same privileges as the OpenS100 process. The vulnerability emphasizes the need for rigorous security measures regarding code execution and privilege management in application environments.

References