Magistrala's Rules Engine permits authenticated users to create server-side executable scripts in Go or Lua triggered by incoming IoT messages. The Go engine uses the Yaegi interpreter exposing the entire Go standard library, including sensitive functions such as os.ReadFile, os.WriteFile, os.Remove, and os.Environ, with only a regex-based validation blocking goroutines and panic calls. The Lua engine performs no input validation and preloads libraries that enable arbitrary database access, file I/O, SSRF, and path traversal. Consequently, an authenticated low-privileged user can exploit this to achieve arbitrary file read/write, environment variable leakage, database access, and SSRF against internal microservices, representing a critical code injection vulnerability (CWE-94).

An attacker with authentication but low privileges can execute arbitrary code on the server via embedded Go or Lua scripts. This leads to full read/write access to files, leakage of environment variables, unauthorized database access, and server-side request forgery (SSRF) attacks against internal microservices. The vulnerability compromises confidentiality, integrity, and availability of the affected system, with a CVSS score of 9.9 indicating critical severity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to trusted users only, and disable or limit the use of embedded scripting in the Rules Engine if possible. Monitor vendor channels for updates and apply official patches or mitigations once released.