CVE-2026-22208

CVE-2026-22208 is a critical remote code execution vulnerability affecting OpenS100, the reference S-100 viewer, prior to commit 753cf29. It allows an attacker to execute arbitrary commands on a user's system by providing a malicious S-100 portrayal catalogue. The vulnerability stems from an unrestricted Lua interpreter that exposes sensitive system libraries. This vulnerability has a CVSS score of 9.6 (CRITICAL) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, requiring user interaction to trigger. There is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available, though it has garnered significant community discussion.