CVE-2026-39842

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39842", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T19:13:20.377Z", "datePublished": "2026-04-14T23:21:22.242Z", "dateUpdated": "2026-04-16T13:58:42.988Z"}, "containers": {"cna": {"title": "OpenRemote is Vulnerable to Expression Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-917", "lang": "en", "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp"}, {"name": "https://github.com/openremote/openremote/releases/tag/1.22.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/openremote/openremote/releases/tag/1.22.0"}], "affected": [{"vendor": "openremote", "product": "openremote", "versions": [{"version": "< 1.22.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T23:21:22.242Z"}, "descriptions": [{"lang": "en", "value": "OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0."}], "source": {"advisory": "GHSA-7mqr-33rv-p3mp", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-16T13:58:20.241436Z", "id": "CVE-2026-39842", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:58:42.988Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39842", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-07T19:13:20.377Z", "datePublished": "2026-04-14T23:21:22.242Z", "dateUpdated": "2026-04-16T13:58:42.988Z"}, "containers": {"cna": {"title": "OpenRemote is Vulnerable to Expression Injection", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-917", "lang": "en", "description": "CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp"}, {"name": "https://github.com/openremote/openremote/releases/tag/1.22.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/openremote/openremote/releases/tag/1.22.0"}], "affected": [{"vendor": "openremote", "product": "openremote", "versions": [{"version": "< 1.22.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-14T23:21:22.242Z"}, "descriptions": [{"lang": "en", "value": "OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0."}], "source": {"advisory": "GHSA-7mqr-33rv-p3mp", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39842", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-16T13:58:20.241436Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-16T13:58:34.902Z"}}]}}

{"affected": [{"affectedData": [{"product": "openremote", "vendor": "openremote", "versions": [{"status": "affected", "version": "< 1.22.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F2709DF-FF1C-4D72-BFEF-FE9FC2C1ECC6", "versionEndExcluding": "1.22.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0."}], "id": "CVE-2026-39842", "lastModified": "2026-06-17T10:42:41.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39842", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-16T13:58:20.241436Z", "version": "2.0.3"}}]}, "published": "2026-04-15T04:17:36.903", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/openremote/openremote/releases/tag/1.22.0"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-917"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.22.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "openremote", "source": "cna", "vendor": "openremote"}, "product": "openremote", "vendor": "openremote"}], "analysis": {"en": {"generated_at": "2026-04-15T00:21:18.419455+00:00", "value": {"mitigation_remediation": ["Upgrade OpenRemote to version 1.22.0 or later to apply the vendor patch that removes the vulnerability.", "Restrict the write:rules role to superusers only or revoke it from non\u2011superusers until the patch is applied.", "Disable JavaScript rule execution entirely by removing or disabling the Nashorn engine or by deleting any existing JavaScript rule definitions.", "If Groovy rules are needed, enable the GroovyDenyAllFilter by uncommenting the registration code so that sandbox security is enforced for superusers as well."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "OpenRemote platform, versions 1.21.0 and earlier. The affected product is the OpenRemote open\u2011source IoT platform. No additional software is listed.", "description_and_impact": "OpenRemote is an open\u2011source IoT platform that allows users to create rules executed by a JavaScript engine without any sandboxing or class filtering. The rules engine evaluates user\u2011supplied scripts via Nashorn's ScriptEngine.eval() and the authorization check erroneously permits JavaScript rules from any user with the write:rules role while only guarding Groovy rules for superusers. This misconfiguration, combined with an unregistered Groovy security filter, allows a non\u2011superuser attacker to create JavaScript rules that run with full JVM privileges, granting remote code execution as root, arbitrary file access, environment variable theft including database credentials, and full multi\u2011tenant isolation bypass. The flaw therefore enables attackers to execute arbitrary code on the server with the privileges of the application process.", "risk_and_exploitability": "The CVSS score of 10 indicates the maximum severity and signifies that the vulnerability allows unrestricted code execution. The EPSS score is not available, so the likelihood of exploitation is unknown, but the fact that any authenticated user with the write:rules role can create the malicious rule means that if an attacker can gain legitimate access or compromise a user account, they can immediately exploit the flaw. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the lack of a supply\u2011chain mechanism for this kind of flaw does not diminish the risk. An attacker can deliver the malicious rule via the standard web interface or API that accepts rule definitions, which makes the attack vector likely to be a remote authenticated compromise. Because the flaw allows escalation to root\u2011level code execution, the potential damage is substantial and would affect all tenants."}}}}, "created": "2026-04-15T13:48:23.613058+00:00", "updated": "2026-04-15T14:28:41.085547+00:00", "vendors": ["openremote", "openremote$PRODUCT$openremote"]}