CVE-2026-22208: CWE-749 Exposed Dangerous Method or Function in OpenS100 Project OpenS100
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
AI Analysis
Technical Summary
The OpenS100 project’s reference implementation of the S-100 viewer prior to commit 753cf29 exposes a remote code execution vulnerability (CVE-2026-22208) by initializing Lua via luaL_openlibs() without sandboxing. This exposes dangerous standard libraries such as 'os' and 'io' to untrusted portrayal catalogues, enabling arbitrary command execution when a malicious catalogue is imported and loaded. The vulnerability is categorized under CWE-749 (Exposed Dangerous Method or Function) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
Potential Impact
An attacker can execute arbitrary commands on the system with the privileges of the OpenS100 process by supplying a malicious S-100 portrayal catalogue containing Lua scripts. This can lead to full system compromise depending on the privileges of the OpenS100 process. The vulnerability requires user interaction (importing and loading a malicious catalogue) but does not require prior privileges or authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing untrusted S-100 portrayal catalogues. Restricting access to the OpenS100 application and running it with minimal privileges may reduce risk. Monitor the OpenS100 Project for updates or official patches addressing this vulnerability.
CVE-2026-22208: CWE-749 Exposed Dangerous Method or Function in OpenS100 Project OpenS100
Description
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
CVSS v4.0
Score 9.4critical
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The OpenS100 project’s reference implementation of the S-100 viewer prior to commit 753cf29 exposes a remote code execution vulnerability (CVE-2026-22208) by initializing Lua via luaL_openlibs() without sandboxing. This exposes dangerous standard libraries such as 'os' and 'io' to untrusted portrayal catalogues, enabling arbitrary command execution when a malicious catalogue is imported and loaded. The vulnerability is categorized under CWE-749 (Exposed Dangerous Method or Function) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere).
Potential Impact
An attacker can execute arbitrary commands on the system with the privileges of the OpenS100 process by supplying a malicious S-100 portrayal catalogue containing Lua scripts. This can lead to full system compromise depending on the privileges of the OpenS100 process. The vulnerability requires user interaction (importing and loading a malicious catalogue) but does not require prior privileges or authentication.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid importing untrusted S-100 portrayal catalogues. Restricting access to the OpenS100 application and running it with minimal privileges may reduce risk. Monitor the OpenS100 Project for updates or official patches addressing this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-01-06T16:47:17.186Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 69947f0d80d747be20b9dc52
Added to database: 02/17/2026, 14:45:33 UTC
Last enriched: 05/26/2026, 20:18:42 UTC
Last updated: 07/09/2026, 07:52:29 UTC
Views: 278
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.