EUVD-2026-53363
GHSA-j4r7-rp8f-vhp4
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Missing auth guard makes the endpoint network-reachable with no privileges (PR:N/AV:N/AC:L), and unsandboxed eval() yields full code execution, so C/I/A all High.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary script field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. The stored script is subsequently executed via quick_js::Context::eval() in api/src/biz/calc_run_biz.rs with no sandboxing, allowing an unauthenticated attacker to achieve arbitrary JavaScript execution in the server process by creating and triggering a malicious calc rule.
AnalysisAI
Unauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in the server process by creating a malicious "calc rule". The POST /calc-rule/create endpoint omits the AuthToken guard applied to other routes, and the supplied script field is later passed unsandboxed to quick_js::Context::eval(), giving full script execution once triggered. CVSS is 9.8; no public exploit identified at time of analysis, though the flaw is trivially reachable and the root cause is confirmed by source-level reference.
Technical ContextAI
rust-iot-platform is a Rust-based IoT data/management platform (Actix-style API in api/src) that evaluates user-defined "calc rules" - small JavaScript expressions used to transform or compute over IoT telemetry - through the QuickJS engine via the quick_js crate's Context::eval(). The vulnerability is a classic CWE-94 Code Injection: attacker-controlled input (the calc rule's script field) flows directly into a language interpreter with no sandbox, allowlist, or timeout, so arbitrary JS runs with the privileges of the API process. Compounding this, the create route in api/src/controller/calc_rule_router.rs does not include the AuthToken request guard used on sibling routes, so the injection sink is reachable pre-authentication. The affected package per CPE is cpe:2.3:a:iot-ecology:rust-iot-platform.
RemediationAI
No vendor-released patch identified at time of analysis and no fixed version was provided, so apply compensating controls immediately. First, restore authentication by adding the AuthToken request guard to POST /calc-rule/create in api/src/controller/calc_rule_router.rs so the endpoint matches the rest of the API; this closes the unauthenticated reachability with minimal functional side effects. Second, eliminate or constrain the eval sink in api/src/biz/calc_run_biz.rs - replace quick_js::Context::eval() on raw user input with a restricted expression evaluator or, if QuickJS must stay, run it with a locked-down context (no host bindings), memory and execution-time limits, and strict input validation of the script field; note this may break legitimate complex rules and require a rule allowlist. As a network-layer stopgap, block or restrict access to the /calc-rule/create endpoint at a reverse proxy or WAF and place the API behind a VPN/trusted network, accepting that this also limits legitimate remote rule management. Track the project repository (https://github.com/iot-ecology/rust-iot-platform) for an official fix and cite the exact patched version once published rather than inventing one.
More in Rust Iot Platform
View allAuthentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpo
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the Au
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to h
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today