What is GHSA-mrrr-7mg7-864j?

GHSA-mrrr-7mg7-864j is a security advisory published by GitHub Security Advisories with High severity. ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution...

Which CVE IDs does GHSA-mrrr-7mg7-864j cover?

GHSA-mrrr-7mg7-864j covers the following CVE IDs: CVE-2026-84858. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mrrr-7mg7-864j?

GHSA-mrrr-7mg7-864j has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-mrrr-7mg7-864jHighCVSS 8.8

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution...

Vendor

GitHub Security Advisories

Published

September 16, 2026

Last Modified

September 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-84858 →

📋 Description

ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass

The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-84858
https://www.tenable.com/security/research/tra-2026-60
https://github.com/advisories/GHSA-mrrr-7mg7-864j