CVE-2026-71278 affects rust-iot-platform, an IoT management platform written in Rust. The vulnerability exists in the POST /calc-rule/create endpoint, which lacks the AuthToken request guard used elsewhere in the application, making it accessible without authentication. An unauthenticated attacker can submit a malicious 'script' field when creating a calc rule. The stored script is later executed via quick_js::Context::eval() in api/src/biz/calc_run_biz.rs without any sandboxing or isolation. This allows an attacker to achieve arbitrary JavaScript execution within the server process. The combination of missing authentication and unsandboxed script execution makes this a critical severity vulnerability. Exploitation requires only the ability to reach the API endpoint and trigger the calc rule execution.