ThingLinks CVE-2026-62853

Requires (1) a valid authenticated session on the ThingLinks platform (CVSS PR:L - a low-privilege account suffices) and (2) network reachability to the rule engine's /groovyScriptTest/registerScript endpoint, which accepts user-supplied Groovy script content and routes it into an unsandboxed Groovy compilation and loading flow. No user interaction, no non-default configuration, and no specific platform are needed - the vulnerable test/register flow is present by default in affected versions below 1.4.0. The single limiting factor is authentication: exploitation is gated on obtaining or abusing an authenticated account, so risk is highest where the ThingLinks management interface is exposed to untrusted or lower-trust authenticated users. Fixed in 1.4.0, which restricts this endpoint and updates the Groovy script handling path.

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C) describes network-reachable, low-complexity exploitation requiring only low-privilege authentication, and the mechanism - unsandboxed Groovy compilation and instantiation of attacker-supplied script content - is a direct, reliable path to server-side code execution rather than a theoretical memory-safety condition. The vuln.today Decision label is act_now, reinforcing urgency. Countervailing signals: no EPSS score is provided, this CVE is NOT listed in CISA KEV, and no verified working exploit code is supplied (the references are the GHSA advisory, the fix commit, and the v1.4.0 release tag - not a PoC). So there is no evidence of active exploitation or public weaponization at this time; the act_now rating rests on the directness and impact of the flaw plus low attack complexity rather than observed in-the-wild use. Note a data discrepancy: the primary CWE in the input is CWE-78 (OS Command Injection), but the GHSA advisory assigns CWE-78 and CWE-94 (Code Injection); the described mechanism - compiling and running arbitrary Groovy - is more precisely code injection (CWE-94) than OS command injection. The barrier to exploitation is authentication, so real-world risk concentrates on deployments exposing authenticated panels to untrusted or lower-trust users.

An attacker who holds any authenticated account on a ThingLinks instance (prior to 1.4.0) sends a request to the rule engine's /groovyScriptTest/registerScript endpoint containing malicious Groovy code. Because the script is compiled and instantiated without sandboxing, the code runs on the server with the privileges of the ThingLinks service, yielding arbitrary command execution. No user interaction and no special timing is required, and attack complexity is low; no public exploit code was identified at time of analysis.