CVE-2026-53676
Description
ThingsBoard contains a prototype pollution vulnerability which may lead to arbitrary code execution within a sandboxed context by a user who can log in to the affected product with the tenant administrator privilege (TENANT_ADMIN).
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1Patches
Vulnerability mechanics
Root cause
"The `args` array passed into the sandbox carried the host realm prototype chain, allowing a script to reach the host `Function` constructor via `args.constructor.constructor` and execute arbitrary code in the host process."
Attack vector
An attacker who can log in as a tenant administrator (TENANT_ADMIN) can craft a rule-chain script that exploits the host-realm prototype chain exposed through the `args` argument. By accessing `args.constructor.constructor`, the script reaches the host `Function` constructor and executes arbitrary code (e.g., reading files, running shell commands, dumping environment variables) in the host process. The attack is carried out via the `/api/ruleChain/testScript` endpoint, which is protected by a `@PreAuthorize('TENANT_ADMIN')` guard but does not prevent a tenant admin from submitting the malicious payload. [ref_id=1]
What the fix does
The patch constructs the `args` array inside the sandbox context using `vm.runInContext('[]', sandbox)` and populates it with string primitives, ensuring the array's prototype chain belongs to the sandbox realm rather than the host realm. This prevents a script from traversing `args.constructor.constructor` to reach the host `Function` constructor. The non-sandbox path (`use_sandbox=false`) is left unchanged but is explicitly documented as dangerous-by-design, with a startup warning logged and a YAML comment added to the configuration file. [patch_id=6466795]
Preconditions
- authThe attacker must be authenticated as a tenant administrator (TENANT_ADMIN).
- configThe `script.use_sandbox` configuration must be set to `true` (the default).
- configThe JS executor must be configured as `remote` (Kafka-based), which is the default for production deployments.
Generated on Jun 18, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
3News mentions
0No linked articles in our index yet.