Vulnerability · Published Oct 30, 2026 · Assigned by GitHub_M

CVE-2026-62853ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

Critical 9.9

In plain English

A critical-severity OS command injection in thinglinks from mqttsnet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)9.9Critical

Exploit odds (30 days)0.4%top 64.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.

Affected products (as reported)

Vendor	Product	Versions
mqttsnet	thinglinks	< 1.4.0

Weakness: CWE-78, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v x_refsource_CONFIRM
https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3 x_refsource_MISC
https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0 x_refsource_MISC