Siemens Mendix Studio Pro Vulnerable to Code Injection
Siemens Mendix Studio Pro versions prior to V11.12 contain a file parsing vulnerability (CVE-2026-48192) that allows for code injection, potentially leading to arbitrary code execution.
Siemens has issued a security advisory detailing a critical vulnerability in its Mendix Studio Pro development platform. Versions prior to V11.12 are susceptible to a file parsing flaw that, if exploited, could allow an attacker to execute arbitrary code within the user's context.
The vulnerability, identified as CVE-2026-48192, stems from improper validation or sanitization of project files processed during the build pipeline. An attacker could craft a malicious project file and trick a user into opening and building it. Successful exploitation would enable the attacker to run code on the victim's system with the same privileges as the Mendix Studio Pro application.
The potential impact is significant, as Mendix Studio Pro is used for developing low-code applications across various industries, including critical manufacturing and energy sectors. The vulnerability affects a wide range of versions, from 10.11 through 11.11, with specific exceptions noted for later versions of 10.24 and 11.6.
Siemens has released updated versions of Mendix Studio Pro to address this vulnerability. Users are strongly advised to update to V10.24.21 or later, or V11.6.7 or later, depending on their current version. For products where fixes are not yet available, Siemens recommends implementing countermeasures to mitigate the risk.
The Common Vulnerabilities and Exposures (CVE) system has assigned CVE-2026-48192 to this flaw. The Common Weakness Enumeration (CWE) categorizes it as CWE-94, Improper Control of Generation of Code ('Code Injection'). The CVSS v3.1 base score is 5.4, rated as MEDIUM severity, reflecting the conditions required for exploitation (high privileges, user interaction, and a configurable scope for the attack).
Siemens ProductCERT reported the vulnerability to CISA, which published the advisory to inform users and critical infrastructure operators. The advisory emphasizes general security best practices, including protecting network access to devices, isolating control system networks, and using secure remote access methods like VPNs.
This incident highlights the ongoing security challenges within the industrial control systems (ICS) and operational technology (OT) landscape. Developers and users of software used in these critical sectors must remain vigilant, applying patches promptly and adhering to robust security guidelines to prevent potential disruptions and data breaches.