OpenS100, the reference implementation of the S‑100 viewer, contains an unrestricted Lua interpreter that can be exploited to run arbitrary code. The engine loads the full Lua standard library with luaL_openlibs, exposing functions such as os and io to untrusted S‑100 portrayal catalogues. Malicious catalogues that embed Lua scripts can invoke these functions and execute commands with the privileges of the OpenS100 process when a user imports and loads a chart, thereby compromising confidentiality, integrity, and availability of the system.

The vulnerability affects the OpenS100 Project:OpenS100 software before the commit 753cf29. All releases built from earlier source code are vulnerable.

The severity score of 9.4 indicates critical risk. The estimated exploitation probability is below 1%, suggesting that attacks are currently rare, but the absence of a listing in the CISA Known Exploited Vulnerabilities catalog does not lower the potential impact for those using older builds. A likely attack vector is a malicious portrayal catalogue that a user imports or that is supplied through social engineering or compromised update channels. Successful exploitation allows an attacker to run arbitrary commands with the same privileges as the OpenS100 process.