Arbitrary JavaScript Execution in Rust IoT Platform by Unauthorized Access

CVE-2026-71278

What is CVE-2026-71278?

The Rust IoT Platform has a significant vulnerability that allows unauthorized users to create and execute malicious 'calc rules' through a specific API endpoint. This endpoint, which does not require authentication, enables attackers to submit arbitrary scripts. When triggered, these scripts are executed directly in the server environment using an execution context with no sandboxing, posing a serious security threat. This vulnerability underscores the importance of implementing proper authentication measures and input validation to safeguard applications from unauthorized script execution.

References