OpenS100, the reference implementation of the S‑100 viewer, contains a remote code execution vulnerability through an unrestricted Lua interpreter. The Portrayal Engine initializes Lua with luaL_openlibs() without sandboxing or capability restrictions, exposing standard libraries such as os and io to untrusted S‑100 portrayal catalogues. An attacker can supply a malicious catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart.

The vulnerability affects the OpenS100 Project:OpenS100 software before the commit 753cf29. All releases built from earlier source code are vulnerable.

The severity score of 9.4 indicates critical risk. The estimated exploitation probability is below 1%, suggesting that attacks are currently rare, but the absence of a listing in the CISA Known Exploited Vulnerabilities catalog does not lower the potential impact for those using older builds. A likely attack vector is a malicious portrayal catalogue that a user imports or that is supplied through social engineering or compromised update channels. Successful exploitation allows an attacker to run arbitrary commands with the same privileges as the OpenS100 process.