CVE-2026-71278

{
  "id": "CVE-2026-71278",
  "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
  "published": "2026-08-05T13:24:52.320",
  "lastModified": "2026-10-23T21:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "rust-iot-platform allows creating a \"calc rule\" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication."
    },
    {
      "lang": "es",
      "value": "rust-IoT-platform permite crear una ’regla de cálculo’ vía POST /calc-rule/create (API/src/controller/calc_rule_router.rs) que contiene un campo ’script’ arbitrario. Esta ruta no utiliza el guard de solicitud AuthToken usado en otras partes de la aplicación, haciéndola accesible sin autenticación. El script almacenado se ejecuta posteriormente vía quick_js::Context::eval() en API/src/biz/calc_run_biz.rs sin sandboxing, permitiendo a un atacante no autenticado lograr la ejecución arbitraria de JavaScript en el proceso del servidor al crear y activar una ’regla de cálculo’ maliciosa."
    }
  ],
  "affected": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "affectedData": [
        {
          "vendor": "iot-ecology",
          "product": "rust-iot-platform",
          "defaultStatus": "unaffected",
          "programFiles": [
            "api/src/controller/calc_rule_router.rs",
            "api/src/biz/calc_run_biz.rs"
          ],
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "*",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-05T15:57:06.656815Z",
          "id": "CVE-2026-71278",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/iot-ecology/rust-iot-platform",
      "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"
    }
  ]
}