Vulnerability in Opens100 Project
CVE-2026-22208
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (59.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 59th percentile — 59.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: +0.000
Affected products
- Opens100 Project — versions 0
Weakness classification (CWE)
References
- www.mdpi.com/1424-8220/26/4/1246 (technical-description, exploit)
- github.com/S-100ExpertTeam/OpenS100/commit/753cf294434e8d3961f20a567c4d99151e3b… (patch)
- www.vulncheck.com/advisories/opens100-portrayal-engine-unrestricted-lua-standar… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-22208?
- CVE-2026-22208 is a critical-severity vulnerability in Opens100 Project, classified under CWE-749. CVSS score: 9.6/10. Published 2026-02-17.
- How severe is CVE-2026-22208?
- Critical severity. CVSS v3 base score is 9.6 out of 10.