Executive brief
ThingsBoard, an open-source IoT platform, contains a security flaw that allows administrative users to bypass security restrictions. A user with Tenant Administrator privileges can exploit a technical weakness in how the system handles JavaScript to execute unauthorized code. This could allow an attacker to gain deeper access to the underlying server, potentially leading to data theft or full system compromise.
Technical details
A prototype pollution vulnerability (CWE-1321) exists in the 'tb-js-executor' component of ThingsBoard. The vulnerability stems from the fact that script arguments passed into the sandbox environment carried the host realm's prototype chain. An attacker with 'TENANT_ADMIN' privileges can leverage this to reach the host's Function constructor via 'args.constructor.constructor', enabling an escape from the sandboxed context to execute arbitrary code on the host process. This can lead to unauthorized file access, shell command execution, and environment variable disclosure. The issue is addressed in version 4.3.1.2 by ensuring arguments are constructed within the sandbox context using 'vm.runInContext'.
Affected products
- ThingsBoard ThingsBoard prior to v4.3.1.2
Timeline
- 2026-05-14: patched: Fix merged into lts-4.2 branch via Pull Request 15600
- 2026-06-16: advisory: JVN advisory published
- 2026-06-17: disclosed: CVE published to NVD