ThingsBoard EUVD-2026-31957

The vulnerable code path is reached when getGatewayDockerComposeFile() processes a gateway host value containing control characters, or when getMqttPublishCommand() processes MQTT credential fields (clientId, userName, password, or credentialsId) containing shell metacharacters such as $, backtick, backslash, or double-quote. The CVSS PR:N metric indicates no authentication is required to reach the /api/v1/provision endpoint per the vector - however, ThingsBoard provisioning endpoints may in practice require a provisioning device key; authentication requirements should be verified against the specific ThingsBoard deployment configuration. User interaction (UI:P in CVSS 4.0, passive) is required: an authenticated operator must view or execute the generated MQTT publish command or Docker Compose file for injection to have impact beyond stored-data corruption. Exploitation is further limited to ThingsBoard instances where gateway Docker Compose generation or MQTT publish command display features are actively used and where operators execute server-generated shell output in a live terminal environment.

The CVSS 4.0 score of 2.3 accurately reflects low exploitability and limited impact: AC:H indicates high attack complexity, UI:P requires passive user interaction (an operator must view or execute the generated output), and all vulnerable-component impact metrics are rated Low (VC:L, VI:L, VA:L) with zero subsequent-scope impact (SC:N, SI:N, SA:N). EPSS of 0.04% at the 11th percentile and SSVC Exploitation: none confirm no observed active exploitation. SSVC also rates Automatable: no, consistent with the AC:H and UI:P constraints. The RCE and Code Injection tags present a potential overstatement: actual remote code execution would depend on whether the server processes the generated Docker Compose or shell commands back through an execution environment, which is not confirmed by available data. The realistic impact is likely injection into operator-facing output (a displayed shell command or downloadable YAML) rather than direct server-side RCE. The description explicitly states exploitation is difficult and the vendor has not yet responded to the responsible disclosure PR. This is not a prioritization candidate absent a specific deployment context where gateway Docker Compose generation or MQTT command display is actively used by operators.

An attacker with access to the ThingsBoard provisioning API submits a device credential - such as a clientId containing $(malicious_command) or a backtick-delimited subshell - that gets embedded without escaping into a generated MQTT publish command displayed to an operator. When the operator copies and executes the displayed command in a terminal, the injected shell metacharacters trigger command substitution, achieving code execution on the operator's machine. No public proof-of-concept exists; high attack complexity and the requirement for operator interaction with the generated output constrain this to targeted rather than opportunistic attacks.