Authenticated users can embed and run Go or Lua scripts within Magistrala’s Rules Engine, which are executed on the server through Yaegi or a Lua interpreter with almost no input validation. The exposed Go standard library and dangerous Lua libraries allow arbitrary file reading and writing, retrieval of environment variables, database access, and SSRF against internal services, leading to complete compromise of confidentiality, integrity, and availability.

The vulnerability affects Magistrala, the IoT platform provided by absmach. No specific version information is supplied in the CVE, so any deployment that includes the described Rules Engine should be considered potentially vulnerable unless the vendor confirms that the issue has been resolved in the release in use.

With a CVSS score of 9.9 the flaw is categorized as Critical. An attacker only needs to be an authenticated, low‑privileged user to craft a rule that contains malicious code; once a message triggers the rule the code executes with the server’s privileges. The absence of an EPSS score and a KEV listing does not reduce the severity, and the attack path is straightforward, indicating a high likelihood of exploitation in an environment where the Rules Engine is enabled.