Home / Vulnerability Intelligence / CVE-2026-39842

CVE-2026-39842 - Vulnerability Analysis

CriticalCVSS: 9.9

Last Updated: April 15, 2026

OpenRemote - Expression Language Injection

Published: April 15, 2026Updated: April 15, 2026Remote Exploitable

Overview

OpenRemote <= 1.21.0 contains expression injection vulnerabilities in the rules engine caused by unrestricted JavaScript rule execution and ineffective Groovy sandboxing, letting attackers with write:rules role execute arbitrary code remotely.

Severity & Score

Severity: Critical

CVSS Score: 9.9

Impact

Attackers with write:rules role can execute arbitrary code as root, read files, steal environment variables, and bypass multi-tenant isolation.

Mitigation

Upgrade to version 1.22.0 or later.

References

https://github.com/openremote/openremote/releases/tag/1.22.0
https://github.com/openremote/openremote/security/advisories/GHSA-7mqr-33rv-p3mp

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-39842
Severity: Critical
CVSS Score: 9.9
Type: expression_language_injection
Status: new

CWE

CWE-94

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H