{"id":"CVE-2026-39842","summary":"OpenRemote is Vulnerable to Expression Injection","details":"OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution on the server. The JavaScript rules engine executes user-supplied scripts via Nashorn's ScriptEngine.eval() without sandboxing, class filtering, or access restrictions, and the authorization check in RulesResourceImpl only restricts Groovy rules to superusers while leaving JavaScript rules unrestricted for any user with the write:rules role. Additionally, the Groovy rules engine has a GroovyDenyAllFilter security filter that is defined but never registered, as the registration code is commented out, rendering the SandboxTransformer ineffective for superuser-created Groovy rules. A non-superuser attacker with the write:rules role can create JavaScript rulesets that execute with full JVM access, enabling remote code execution as root, arbitrary file read, environment variable theft including database credentials, and complete multi-tenant isolation bypass to access data across all realms. This issue has been fixed in version 1.22.0.","aliases":["GHSA-7mqr-33rv-p3mp"],"modified":"2026-08-12T16:23:59.303056Z","published":"2026-04-14T23:21:22.242Z","database_specific":{"cwe_ids":["CWE-917","CWE-94"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39842.json","cna_assigner":"GitHub_M"},"references":[{"type":"WEB","url":"https://github.com/openremote/openremote/releases/tag/1.22.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39842.json"},{"type":"ADVISORY","url":"https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39842"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openremote/openremote","events":[{"introduced":"0"},{"fixed":"01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a"}],"database_specific":{"cpe":"cpe:2.3:a:openremote:openremote:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.22.0"}],"source":["AFFECTED_FIELD","CPE_RANGE","REFERENCES"]}}],"versions":["1.21.0","1.20.2","1.20.1","1.20.0","1.19.0","1.18.0","1.17.3","1.17.2","1.17.1","1.17.0","1.16.1","1.16.0","1.15.2","1.15.1","1.15.0","1.14.0","1.13.1","1.13.0","1.12.3","1.12.2","1.12.1","1.12.0","1.11.3","1.11.2","1.11.1","1.11.0","1.10.0","1.9.0","1.8.1","1.8.0","archive/console_loader","1.7.0","1.6.5","1.6.4","1.6.3","1.6.2","1.6.1","1.6.0","1.5.0","1.4.0","1.3.5","1.3.4","1.3.3","1.3.2","1.3.1","1.3.0","1.2.4","1.2.3","1.2.2","1.2.1","1.2.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-39842.json","vanir_signatures_modified":"2026-08-12T16:23:59Z","vanir_signatures":[{"source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java","function":"createAssetRuleset"},"deprecated":false,"digest":{"function_hash":"262344609711769585219135329869613188667","length":845},"id":"CVE-2026-39842-37d50ee0","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-39842-3edbc1da","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"function":"updateAssetRuleset","file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"},"deprecated":false,"digest":{"function_hash":"8706605273139416489710717079014470320","length":1120}},{"digest":{"function_hash":"313343722639178910085870984596500631147","length":738},"id":"CVE-2026-39842-509088db","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java","function":"createRealmRuleset"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"239216556527686170801138448147896421414","length":1042},"id":"CVE-2026-39842-63e82d11","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java","function":"updateRealmRuleset"}},{"id":"CVE-2026-39842-6726753b","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java","function":"createGlobalRuleset"},"deprecated":false,"digest":{"function_hash":"23750766590422561149341149817927868774","length":224}},{"source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java"},"deprecated":false,"digest":{"line_hashes":["112177918831219321789302284231646925924","281016791494566277055451453835392322351","234527408294299625685965633984573904830","150710123105791639586632071340029904677","200063947854724540074844026963290864192","231817165535170052902813136054828579437","235173485976027128267946884327159583388","337322016445520090871580920620755738814","51624397522206463083153065240716992003","43198958533983064107034712154402640180","280180513320814117172003745808398288686","94232593780625956445425058410441557537","28867856239357858183764256852698406868","169256043002585225732069110444502945582","139450067191708954668090879286328397964","252220856526893180968698909048904523350","251477720559099737518955913553683118032","41151026617945397478562086402072390221","64361593445085278552785041780655906916","26992697100225001529632553185442153658","85594102238729924552776620441480065139","183594254886767809243406255531604195224","224305828430982708018571672826079009010","98896770493275538418293024305801992973","287612939809819808353431626194085410710","211208660778872008416238637852019169807","265241446529439970507664511176747632027","187685193456521700313520400887318688426","61949475220696697323519046146774456983","131020772823381640243946383974309601707","11947260563646349732442621267070023821","35366639649072962228766886302008624553","205204242589338735351875457547631886573","186788520392797137255169446135960994584","206944794018509352691082084271884526160","123008567835099082238139535700465162281","171556408870698126300319792204858222476","207657195822116753123919493000507836977","260939235861937780482067559565820809286","304706852521201061953798965564861229102","17758992882948861437311839470770212686","177195478387223754210897916555738953053","114655371386780120218654163948166693505","100621888865719254400633513288981992178","143423705233959370071949180814197697516","306138479810186136863364359259726578240","261408575225256879194611652890007466232","299658873351745869662924006320080897226","204126127862269920109082435660749242914","54002510509137532010167292322913694191","328650404464818397246206744093382207446","88344280869640133267136098617414019531","97571362714039652177316355187240355497","161411763495113688268860840139367682726","258900937447131683129953277596787064213","245182827686026477463023314336377775317","85142576242526503933786737793677124537","236467789225748061769717498281427454625","274286773438040181714181145572846460558","270483383047897253813839411803386426299","84875847172557275557413750944530938909","66197398498126513371580950865282362290","121545549385577211026582012276719756734","291806483705322113067447544241165321121","271419102224634406123739657470481889128","258294648820505720915643533471915198621","57913482630293055247843830801643052884","177451187483388990420056896715446098679","125957865427168381506314374907799990471","237786916098577377547506914374859754568","311439016338914154566701670176681604313","155362788877685668400670509444092661330","53366356929108239489413424997100846997","65874381006390969751822857052668920435","284966103695415453434801786850952463712","154691394643270385953504413749555863450","140299306511013655736022106057246159513","141078585313240755696353768958134406869","297397391136999809275838040246142258164","61076505722115561438623082179342768626","183277482881292955756829641287368107731","332745819605960512830897317537609690715","248871381418161129773678321788207855592","111909580583550666515129590985647964534","259426649198093629902587589200885047463","62381167751205612797430815817639872849","227721457931792907764660251870427873170","212588408053927830596876115499348969701","50958172794040486660380230127812494966","70810886678301505787465035506703369742","132045808438171730817952078205995870051","131476212431099935993443825440810934612","321668903206886327023904363037390568460","268713166517111344940180474289780232909","24646273672984608312179702194312137300","142607849261546125502905596920105571469","256565001709244697310156263536489152764","7459714439687820607069342072064106183","308997130535485444288285717357538941118","105615059841502486486024027701209971124","216668790405931191149900938799418182151","289055017581204730413229648807443845589","229085819657994259424410848480846420671","8135872098152583677584617115888369191","47564345775939600803349008163984559901","271965613321513406536347651275409934622","87749176698411116380500880887244283673","185585915848765841438832636104688144","237078397548637749132476236197847058352","100950431841759841155201654293641938719","104040620987424471909076294167552217287","42295604171558620778286606655016750089","148449522587184979339152322018653350429","146119753620399733297157749586971196922","221639201178402596154700649658811499549","335662227921298198810888737974728615277","220779791296060847619771503170553352668","279029363541655763150484096322166437270","53296140370134297658345253517038752476","175795233875733511948768615994476850149","184769477897914954413364766198862157778","222320727219299053933484509452127198331","214075026288239849307161384999143092894","198267632902915803709100947835135181195","39143615960824914349223664586458162495","71999737552737318531891204895267096595","336623950052441005206096056923237709025","235409075945205606490417773587270074991","91133196277642883441889676870362250621","335786931192972751699223969730155935951","199078223550782745250857137045637046628","215736141312864228258229395753968991039","262847712781325743016367370779180814383","53311562850490860075351037760532816518","223794098941927126015761623233463704125","75415360871939178263697850838488384878","2419179758707896021147423333302747984","195943660094307605808023564323051466149","160766870716035989369134368411228263482","130596627496827395043183905856366122274","143242994109244695268326404337282195080","60498338279330268111857907009550108742","282481845130950117182825395220618626458","201301613833145950066404319110308192925","12206355343291561201347055413551215537","208939188882308207428203317392569323220","148590635730546638216041557549999523851","196511641864717736276772784850230864193","226256395860715899107930153660432548294","258256479446802877685393770520894731685","14715293635842366239090581385860834980","230209881071809857475378186244753158489","316690669290082975896842410849135067181","193945808628594412366544287625663367568","80496749102163105102572109980890103606","253420946508311583007643808657070692011","250067154963237393265757049998409392588","262879408649966382084216231729199520223","1905296531889858012359589845363701856","217412351361473362387067259354594182603","284086336432053641203796754142889167106","9317071801753129416553807381033427993","77175588494147154310525843667730591430"],"threshold":0.9},"id":"CVE-2026-39842-8bd86ace","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"187661022738469871598207265681082711096","length":673},"id":"CVE-2026-39842-a9757117","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java","function":"compile"}},{"target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java","function":"updateGlobalRuleset"},"deprecated":false,"digest":{"function_hash":"300247437249595470476319436472399558951","length":327},"id":"CVE-2026-39842-d0a32b67","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a"},{"deprecated":false,"digest":{"function_hash":"2080715412182694399303458494523305639","length":3249},"id":"CVE-2026-39842-ea0684a3","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java","function":"compileRulesJavascript"}},{"target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesResourceImpl.java"},"deprecated":false,"digest":{"line_hashes":["37958179051547056858287815818074482265","159050053260340748696707992800986485386","128724947228055690515959518170165012443","107396264951875272351435592664968478974","16457912837449657953931467138898513433","74271296167072545644843568656288976390","94625434813896695115204947231385316495","33610438320407802861092608131139789230","320009213869842826415994469184746231435","206903225121959046185715030483708396944","288703573091063269152258348223996455722","111816029480637543700605363134019832216","58033314382984668077634447562584584059","233266346590369204167497235739894839525","89864015341200578567443920843056187280","256361074168301498799654483511784181442","83912281639285818971409498355923241971","340102317641541741971898514225774272504","142289329687401390960556078455108359166","84565309990862581070178937620269014450","103259328080334252180221455197695723512","134651681777775846991228162492041447023","182959010706731871031572872758364986580","86535444414622157003190278245797510092","73890621102773919521510340938813052275","329260615696629227153403503731897377575","182959010706731871031572872758364986580","140325795727374179258384831670895794561","223673099651945052022225583990877392179","52339075279001488567980257908346045638","182959010706731871031572872758364986580"],"threshold":0.9},"id":"CVE-2026-39842-fad6dd53","signature_type":"Line","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a"},{"deprecated":false,"digest":{"function_hash":"67317061036767981956705330212159853702","length":2081},"id":"CVE-2026-39842-fd639e7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/openremote/openremote/commit/01d9cc2f6b65e1c8847bcb2922bdd897dd0a2f1a","target":{"file":"manager/src/main/java/org/openremote/manager/rules/RulesetDeployment.java","function":"compileRulesJavascript"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}]}