Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🔴 mqttsnet thinglinks 1.4.0 fixes 2 critical CVEs Worst: remote code execution in rule engine (CVE-2026-62853) Patch → 1.4.0 https://cve.now/CVE-2026-62853?release=CVE-2026-62849&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup