The vulnerability exists in the magistrala product by absmach, specifically in its Rules Engine which allows authenticated users to embed Go or Lua scripts executed on the server side upon receiving IoT messages. The Lua script engine (re/lua.go) does not perform any input validation and preloads several powerful libraries such as db (enabling arbitrary database access), ioutil (file input/output), an HTTP client (enabling server-side request forgery), and filepath (enabling directory traversal). This creates a code injection risk classified under CWE-94, allowing attackers with authenticated access to execute arbitrary code with high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user to execute arbitrary code on the server hosting magistrala, potentially leading to full system compromise. The attacker can access or manipulate the database, read or write files, perform SSRF attacks, and traverse the file system. The CVSS 3.1 score is 8.8 (high), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict authenticated user permissions to trusted individuals only and monitor for suspicious activity related to rule creation and script execution.