EUVD-2026-37828
GHSA-prc2-x3qx-38m9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain TENANT_ADMIN credentials
-
DeliveryAuthenticate to ThingsBoard API
-
ExploitSubmit crafted script to /api/ruleChain/testScript
-
ExecutionTraverse args.constructor.constructor prototype chain
-
PersistSynthesize Function returning host process
-
ImpactExecute arbitrary code on tb-js-executor host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V3 - Web Frontend Security Prototype pollution prevention
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated session with the TENANT_ADMIN role on a ThingsBoard instance prior to v4.3.1.2; CUSTOMER role is insufficient (the patch adds a separate test confirming |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, base 8.6) reflects a remote, low-complexity attack that nevertheless requires high privileges - specifically a logged-in TENANT_ADMIN - which materially limits the population of viable attackers to insiders or attackers who have already compromised tenant credentials. There is no EPSS score, KEV listing, or public PoC supplied; SSVC signals were not provided. Real-world priority is moderate-to-high for multi-tenant ThingsBoard deployments (especially SaaS or shared instances) where tenant-admin compromise must not yield host RCE on the js-executor node, but lower for single-tenant deployments where the tenant admin is already trusted. Note that the CVE describes arbitrary code execution 'within a sandboxed context', while the upstream regression test demonstrates reaching the host |
| Exploit ScenarioDerived | An attacker who has obtained TENANT_ADMIN credentials (via phishing, credential reuse, or as a malicious insider on a shared ThingsBoard instance) submits a crafted rule-chain test script through POST /api/ruleChain/testScript containing |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Jun 18, 2026
Sandbox escape via prototype pollution in ThingsBoard (versions prior to v4.3.1.2) allows a TENANT_ADMIN-authenticated user to achieve arbitrary code execution within the tb-js-executor sandboxed JavaScript context. The flaw lets a rule-chain script reach the host realm through the args.constructor.constructor chain (e.g., synthesizing a Function that returns process), defeating the intended VM isolation. No public exploit identified at time of analysis, though the upstream regression test in PR #15600 effectively documents the escape technique.
Earlier versions of this analysis (2)
Arbitrary code execution in ThingsBoard versions prior to v4.3.1.2 is achievable by a TENANT_ADMIN-level user who submits a malicious rule-chain script that leverages prototype pollution to traverse the script argument's constructor chain and execute attacker-controlled code inside the tb-js-executor sandboxed context. The flaw was reported by JPCERT (JVN#16937365) and patched in upstream PR #15600; no public exploit was identified at time of analysis and the issue is not listed in CISA KEV.
Prototype pollution in ThingsBoard (CWE-1321) allows an authenticated user holding the TENANT_ADMIN role to traverse the JavaScript prototype chain inside the rule-chain script sandbox (tb-js-executor) and execute arbitrary code. The flaw lives in how user-supplied script arguments are bound into the sandbox realm - args.constructor.constructor resolves to the host realm's Function constructor, enabling reach into the Node.js host (e.g., process). No public exploit identified at time of analysis and not listed in CISA KEV; CVSS 7.2 reflects the high-privilege precondition.
RemediationAI
Vendor-released patch: ThingsBoard v4.3.1.2 - upgrade to this version or later, which contains the JsExecutor sandbox hardening from PR https://github.com/thingsboard/thingsboard/pull/15600 and the accompanying regression test. Until the upgrade is applied, restrict TENANT_ADMIN role assignment to trusted operators, rotate tenant-admin credentials, and audit rule chains for suspicious scripts referencing constructor.constructor, process, require, or mainModule; on multi-tenant deployments consider temporarily disabling the rule-chain testScript and script-node functionality for untrusted tenants (this disables legitimate rule-engine JS development workflows). Do not rely on script.use_sandbox=false as a workaround - the patched code now explicitly warns that this mode runs scripts in the host realm with no isolation.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ThingsBoard is an open-source IoT platform whose rule engine lets tenants author JavaScript snippets that are evaluated by the tb-js-executor microservice (Node.js vm.runInNewContext against a sandbox object). CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes - 'Prototype Pollution') applies because user-controlled args reached the script with an accessible prototype chain, exposing args.constructor.constructor and thereby host-realm globals such as process. The fix in PR #15600 hardens the JsExecutor (msa/js-executor/api/jsExecutor.ts) sandbox construction and adds a black-box regression (JsExecutorSandboxIsolationTest) asserting that synthesizing Function('return process')() from within the script throws 'process is not defined'.
Know when Thingsboard gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable API, low complexity, requires TENANT_ADMIN (PR:H), no UI; sandbox escape crosses trust boundary into host js-executor process so S:C with full CIA impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
1DescriptionCVE.org
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).
Executive ViewAI
ThingsBoard versions prior to v4.3.1.2 contain a sandbox escape vulnerability in the JavaScript rule-chain executor that allows authenticated tenant administrators to achieve arbitrary code execution. This vulnerability (CVSS 8.6) exposes organizations to privilege escalation attacks from compromised or malicious admin accounts and could lead to lateral movement within connected systems. With no vendor patch currently available, affected deployments face elevated operational risk.
Restrict TENANT_ADMIN role assignment to trusted personnel only. Disable JavaScript-based rule-chain execution if operationally feasible. Implement enhanced audit logging on all rule-chain script creation and modification; monitor tb-js-executor runtime logs for suspicious JavaScript patterns (e.g., 'constructor', 'Function', 'eval'). Implement network segmentation to limit blast radius if code execution occurs. Regularly audit existing rule-chain scripts for indicators of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Thingsboard
View allThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because A
ThingsBoard before v3.2 is vulnerable to Host header injection in password-reset emails. Rated high severity (CVSS 8.8),
An arbitrary file upload vulnerability in the Image Gallery of ThingsBoard Community, ThingsBoard Cloud and ThingsBoard
A vulnerability classified as problematic was found in ThingsBoard up to 3.6.2. Rated medium severity (CVSS 6.5), this v
A vulnerability has been found in ThingsBoard up to 3.7.0 and classified as problematic. Rated medium severity (CVSS 6.0
Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted
Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileg
ThingsBoard 3.4.1 could allow a remote attacker to gain elevated privileges because hard-coded service credentials (usab
SVG-based server-side request forgery in ThingsBoard versions prior to 4.2.1 allows upload of crafted SVG files containi
Code injection in ThingsBoard 4.3.1.0 and 4.3.1.1 allows remote attackers to embed control characters and shell metachar
A vulnerability was detected in ThingsBoard 4.1. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploi
Exploit-DB