Siemens Mendix Studio Pro

An attacker could modify or inject malicious files outside the intended project directory during module installation, potentially compromising the integrity of development environments and allowing injection of backdoors into deployed applications. This could affect deployed Mendix applications if malicious code is embedded during development.

Application developers using Siemens Mendix Studio Pro for low-code application development, particularly those deploying applications to OT environments or creating integration logic for industrial systems. This affects development teams using Mendix versions 8, 9, 10, 10.6, 10.12, 10.18, and 11. Risk is highest for development teams that may be tricked into installing modules from untrusted sources.

An attacker would need to trick a developer into installing a malicious or compromised Mendix module into their Studio Pro project. During installation, the vulnerable module installation process could be exploited to write files outside the project directory, such as into system directories or shared development folders. This requires developer interaction to install an untrusted module.