Live › vulnerability › CVE-2026-78190
WebDyne, a Perl web framework, copies request parameters unescaped into form field value attributes in its textfield, password_field and filefield tags. An attacker can use a crafted link to inject script that runs in the victim's browser on affected pages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 15:36 UTC. All times on this page are UTC.
Applications built on WebDyne that render form tags from request parameters are exposed, since the reflected value reaches the page unescaped. Sites that do not use these tags with user-supplied input, or that run only static content, are less exposed. The sources do not say whether WEBDYNE_CGI_AUTOESCAPE offers any protection on versions 2.022 and later.
No product ranges from the sources yet.
perl -MWebDyne -e 'print $WebDyne::VERSION' or the module's version in your cpanfile or lockfile; versions from 2.014 before 3.022 are affected.textfield, password_field or filefield tags that take request parameters.WEBDYNE_CGI_AUTOESCAPE is set in your configuration; the default is off and enabling it does not help from 2.022 on.3.022 or later (the sources state the fixed version is 3.022).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting.
The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect.
A remote attacker can inject script into any page using these tags through a crafted link.
This page as .md · .json · in your agent: get_signal("CVE-2026-78190")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.