CVE-2026-22208

OpenS100 (reference S-100 viewer) before commit 753cf29 is vulnerable to remote code execution via an unrestricted Lua interpreter. The Portrayal Engine calls luaL_openlibs() without sandboxing, exposing standard libraries such as os and io to untrusted portrayal catalogues. An attacker can suppl...

PT-2026-20300

Name of the Vulnerable Software and Affected Versions OpenS100 versions prior to commit 753cf29 Description The software contains a remote code execution issue due to an unrestricted Lua interpreter. The Portrayal Engine initializes Lua using luaL openlibs without sandboxing or capability...