The OpenS100 project’s reference implementation of the S-100 viewer prior to commit 753cf29 is vulnerable to remote code execution because it initializes the Lua interpreter using luaL_openlibs() without any sandboxing or capability restrictions. This exposes dangerous standard libraries such as 'os' and 'io' to untrusted input. An attacker can craft a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary system commands with the same privileges as the OpenS100 process when a user imports and loads the catalogue, leading to full compromise of the affected system.

Successful exploitation allows an attacker to execute arbitrary code remotely with the privileges of the OpenS100 process. This can lead to full system compromise, data theft, or further network pivoting. The vulnerability requires user interaction (importing a malicious portrayal catalogue) but does not require prior authentication or elevated privileges.

No official patch or fix is currently available as per the provided data. Users should avoid importing untrusted S-100 portrayal catalogues until a fix is released. Monitor the OpenS100 project for updates or commits addressing this vulnerability, specifically changes that sandbox or restrict the Lua interpreter initialization. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.