CVE-2026-71278 iot-ecology CVE debrief

Who should care

Administrators and users of rust-iot-platform, security teams monitoring for potential JavaScript execution vulnerabilities, and developers using similar calc rule functionality should be aware of this vulnerability and take necessary defensive actions. Affected operators should review their calc rule configurations and verify the authenticity of calc rule creations. Vulnerability management teams should prioritize patching or mitigating this vulnerability, and security teams should monitor for suspicious activity.

Technical summary

The rust-iot-platform allows creating a calc rule via POST /calc-rule/create containing an arbitrary script field. This route does not require authentication, making it reachable without an AuthToken. The stored script is subsequently executed via quick_js::Context::eval() without sandboxing, allowing an unauthenticated attacker to achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule. The vulnerability is caused by the lack of authentication and sandboxing in the calc rule execution process.

Defensive priority

Unauthenticated attackers can execute arbitrary JavaScript in the server process, indicating a high priority for defensive actions.

Recommended defensive actions

• Verify and apply vendor remediation if available
• Implement compensating controls such as Web Application Firewalls
• Monitor for suspicious calc rule creations and JavaScript execution
• Perform inventory checks for rust-iot-platform usage
• Restrict access to calc rule creation endpoints
• Review calc rule configurations for suspicious activity
• Track exceptions and retest remediated assets

Evidence notes

Evidence from the NVD and CVE.org indicates that the vulnerability allows unauthenticated arbitrary JavaScript execution. Further verification is needed to determine the full scope of affected systems and potential mitigations. The vulnerability is caused by the lack of authentication in the calc rule creation endpoint, which allows an attacker to create a malicious calc rule. The calc rule is then executed without sandboxing, allowing the attacker to achieve arbitrary JavaScript execution in the server process. To verify the affected systems, defenders should review the calc rule creation endpoint and check for suspicious activity.

Official resources