---
id: CVE-2026-62853
title: >-
  ThingLinks vulnerable to authenticated remote code execution via Groovy script
  registration in ThingLinks
summary: >-
  ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the
  `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy
  script content and passes it to an unsandboxed `Groovy compilation and
  loading` flow. An authenticated…
severity: critical
cvss: 9.9
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-78
  - CWE-94
vendor: mqttsnet
product: thinglinks
affected:
  - thinglinks < 1.4.0
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T20:28:07.829Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-62853'
references:
  - url: >-
      https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v
    label: >-
      https://github.com/mqttsnet/thinglinks/security/advisories/GHSA-9vph-5ccx-qp9v
  - url: >-
      https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3
    label: >-
      https://github.com/mqttsnet/thinglinks/commit/311ee760dad798f48652722989fcea02349e13a3
  - url: 'https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0'
    label: 'https://github.com/mqttsnet/thinglinks/releases/tag/v1.4.0'
tags:
  - cve.org
epss: 0.00406
epssPercentile: 0.35052
ingestedAt: '2026-11-05T16:24:31.462Z'
---

## Overview

ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.

## Affected

- `thinglinks < 1.4.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.