Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contains a remote code execution vulnerability via an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as 'os' and 'io' to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-17 | 5 | Disclosure3Patch1PoC1 |
| 2026-02-22 | 1 | Disclosure1 |
CVE-2026-22208 Remote Code Execution in OpenS100 Viewer via Unrestricted Lua Interpreter https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22208
Post summary
The text announces CVE-2026-22208, describing a remote code execution vulnerability in OpenS100 Viewer caused by an unrestricted Lua interpreter.
CVE-2026-22208 OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contain a remote code execution vulnerability via an unrestricted Lua interpreter. The Po… https://www.cve.org/CVERecord?id=CVE-2026-22208
Post summary
CVE-2026-22208 is a remote code execution flaw in OpenS100’s viewer due to an unrestricted Lua interpreter, with a Proof of Concept referenced; no exploit code, active exploitation, or patch information is provided.
CVE-2026-22208 (CVSS:9.4, CRITICAL) is Awaiting Analysis. OpenS100 (the reference implementation S-100 viewer) prior to commit 753cf29 contain a remote code execution vulnerabili..https://nvd.nist.gov/vuln/detail/CVE-2026-22208 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-22208, a critical remote code execution vulnerability in OpenS100 before commit 753cf29, with CVSS 9.4, but provides no PoC, exploit, patch, or active exploitation details.
🚨 CRITICAL RCE alert! OpenS100 S-100 viewer exposes dangerous Lua methods — attackers can run code via malicious portrayal catalogues. Patch ASAP or block untrusted imports. https://radar.offseq.com/threat/cve-2026-22208-cwe-749-exposed-dangerous-method-or-4594ea65 #OffSeq #CV... https://t.co/8wTgIPE1KX
Post summary
OpenS100 S‑100 viewer exposes dangerous Lua methods, enabling remote code execution; users should patch immediately or block untrusted imports to mitigate the vulnerability.
There is a new vulnerability with elevated criticality in OpenS100 (CVE-2026-22208) https://vuldb.com/?id.346281
Post summary
A new high‑criticality vulnerability (CVE-2026-22208) has been disclosed in OpenS100.
🚨 CVE-2026-22208: OpenS100 Portrayal Engine Unrest... Maritime security alert: OpenS100's unsandboxed Lua interpreter allows trivial RCE via malicious portrayal catalogues -... https://zerodaysignal.com/vulnerability/CVE-2026-22208 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
OpenS100's unsandboxed Lua interpreter permits trivial remote code execution through malicious portrayal catalogues, with technical details disclosed but no PoC, exploit tool, active exploitation, or patch information provided.