rust-iot-platform allows unauthenticated creation of a calc rule via the /calc-rule/create endpoint, which accepts an arbitrary JavaScript script field. Because the stored script is run without sandboxing through quick_js::Context::eval(), an attacker who can create and trigger such a rule can execute any JavaScript code with the privileges of the server process, leading to total compromise of confidentiality, integrity, and availability.

All versions of rust‑iot‑platform deployed by iot‑ecology are potentially affected. The lack of authentication on the vulnerable endpoint means that any user with network access to the API can exploit it.

The CVSS score of 9.8 indicates that the vulnerability is critical, with a full impact if exploited. Although the EPSS score is not available, the absence of a CISA KEV listing does not reduce the risk, as the vulnerability can be leveraged remotely through a simple POST request to /calc-rule/create. The attacker does not need any privileges and can trigger the malicious script after rule creation, making exploitation straightforward for anyone with network reach to the API.