ThingLinks: Authenticated remote code execution via Groovy script registration
Summary
ThingLinks, an enterprise IoT platform from mqttsnet, passes Groovy script content submitted to the /groovyScriptTest/registerScript endpoint to an unsandboxed compilation and loading flow. An authenticated attacker with low privileges can have arbitrary code compiled and run on the server. This allows high impact on confidentiality, integrity and availability, with the server's privileges. All versions before 1.4.0 are affected.
Affected
- ThingLinks versions before 1.4.0
- Component: rule engine, Groovy script test/register flow
Fixed in
- Upgrade to ThingLinks 1.4.0 (release v1.4.0). The vendor removed the externally reachable test controllers and restricted dynamic execution to internal service calls.
- Unknown whether older branches received a backport.
Workaround
Unknown. The vendor documents no workaround. Possible interim measures (not from the vendor):
- Restrict access to the script test and register endpoints, for example at the reverse proxy
- Limit rule-engine and script rights to trusted staff
- Review already registered Groovy scripts for unexpected content
Exploitation
- No exploitation in the wild known at the time of writing.
- Not listed in CISA KEV.
- No public proof of concept known.
- The CVE was published on 30 October 2026, so the status may change quickly.
Our recommendation
- Upgrade ThingLinks to 1.4.0 without delay.
- Until the upgrade is done, restrict access to the script endpoints and limit script rights to trusted accounts.
- Check whether ThingLinks is self-hosted and reachable from the internet; if so, treat this as high priority.
- Review registered Groovy scripts and recent rule-engine changes for unexpected content.
- Monitor logs for requests to /groovyScriptTest/registerScript from unknown accounts or addresses.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-9vph-5ccx-qp9v github.com
- Fix commit 311ee760dad798f48652722989fcea02349e13a3 github.com
- ThingLinks release v1.4.0 github.com
- ThingLinks project repository github.com
- CVE-2026-62853 record mirror cve.threatint.com
- OffSeq Radar: CVE-2026-62853 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:20.
Original description (NVD)
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, the `/groovyScriptTest/registerScript` endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed `Groovy compilation and loading` flow. An authenticated attacker can provide code that is compiled and instantiated on the server, resulting in arbitrary server-side code execution. The issue affects the `rule engine`'s Groovy script test/register flow. This issue is fixed in version 1.4.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.