CVE-2026-22208
Remote Code Execution in OpenS100 via Unrestricted Lua Interpreter
Publication date: 2026-02-17
Last updated on: 2026-02-17
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opens100 | opens100 | to 753cf29 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-829 | The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
| CWE-749 | The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
[{'type': 'paragraph', 'content': "CVE-2026-22208 is a critical remote code execution vulnerability in OpenS100, the reference implementation of the S-100 maritime navigation portrayal engine. The vulnerability exists because the Portrayal Engine initializes the Lua interpreter with full standard libraries (including dangerous ones like 'os' and 'io') without sandboxing or restricting capabilities. This allows untrusted S-100 portrayal catalogues to include malicious Lua scripts that can execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart."}, {'type': 'paragraph', 'content': 'The root cause is that the Lua environment is opened using luaL_openlibs() without disabling dangerous functions, exposing operating system commands to untrusted code.'}] [1, 2]
How can this vulnerability impact me? :
[{'type': 'paragraph', 'content': 'This vulnerability can allow an attacker to execute arbitrary commands on the system running OpenS100 with the same privileges as the OpenS100 process. This means an attacker could run any executable or script, potentially leading to full system compromise, data theft, or disruption of services.'}, {'type': 'paragraph', 'content': "Since the Lua interpreter exposes dangerous libraries like 'os' and 'io', malicious Lua scripts embedded in S-100 portrayal catalogues can launch executables such as calculators or notepads as proof of concept, but more harmful commands could be executed in a real attack."}] [1, 2]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking if the OpenS100 Portrayal Engine is running a version prior to commit 753cf29, which does not disable dangerous Lua standard libraries such as 'os' and 'io'."}, {'type': 'paragraph', 'content': "One way to detect exploitation attempts is to monitor for Lua scripts or S-100 portrayal catalogues that attempt to execute operating system commands via the Lua 'os' library, such as calls to 'os.execute'."}, {'type': 'list_item', 'content': 'Check the OpenS100 version or commit hash to confirm if the patch is applied.'}, {'type': 'list_item', 'content': "Search for Lua scripts containing calls to 'os.execute' or usage of 'io' and 'debug' libraries in imported portrayal catalogues."}, {'type': 'list_item', 'content': "Monitor process activity for unexpected executions of system commands like 'calc.exe' or 'notepad.exe' triggered by the OpenS100 process."}, {'type': 'paragraph', 'content': 'Specific commands depend on your environment, but examples include searching for suspicious Lua code in files or logs, and using system monitoring tools to detect unusual process executions initiated by OpenS100.'}] [1, 2]
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The immediate mitigation step is to update OpenS100 to the version including the patch at commit 753cf29 or later, which disables dangerous Lua standard libraries and functions.'}, {'type': 'list_item', 'content': "Apply the security patch that disables the 'os', 'io', 'debug' libraries and other unsafe Lua functions by setting them to nil."}, {'type': 'list_item', 'content': 'Avoid importing untrusted or unauthenticated S-100 portrayal catalogues that may contain malicious Lua scripts.'}, {'type': 'list_item', 'content': 'Implement monitoring to detect attempts to execute arbitrary commands via Lua scripts within OpenS100.'}, {'type': 'paragraph', 'content': 'These steps prevent attackers from exploiting the unrestricted Lua interpreter to execute arbitrary code with the privileges of the OpenS100 process.'}] [1, 2]