PT-2026-20300 · Opens100 · Opens100

Hoyeon Cho · Published 2026-02-17 · Updated 2026-05-26 · CVE-2026-22208

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenS100 versions prior to commit 753cf29

Description The software contains a remote code execution issue due to an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL openlibs() without sandboxing or capability restrictions, exposing standard libraries like os and io to untrusted portrayal catalogues. An attacker can provide a malicious S-100 portrayal catalogue containing Lua scripts that execute arbitrary commands with the privileges of the OpenS100 process when a user imports the catalogue and loads a chart. The vulnerable component is the Lua interpreter within the Portrayal Engine.

Recommendations Versions prior to commit 753cf29 should be updated to commit 753cf29 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

CWE-749

Related Identifiers

CVE-2026-22208

Affected Products

Opens100

References · 12

• 🔥 https://mdpi.com/1424-8220/26/4/1246 · Exploit
• https://github.com/S-100ExpertTeam/OpenS100/commit/753cf294434e8d3961f20a567c4d99151e3b530d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22208 · Security Note
• https://osv.dev/vulnerability/CVE-2026-22208 · Vendor Advisory
• https://twitter.com/vuldb/status/2023776098040115499 · Twitter Post
• https://twitter.com/cracbot/status/2025526031944503515 · Twitter Post
• https://t.me/CVEtracker/44877 · Telegram Post
• https://twitter.com/0dayPublishing/status/2023769418472280515 · Twitter Post
• https://t.me/cveNotify/164701 · Telegram Post
• https://vulncheck.com/advisories/opens100-portrayal-engine-unrestricted-lua-standard-library-access · Note
• https://twitter.com/CVEnew/status/2023776009925833187 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2023785248375336975 · Twitter Post