CVE-2026-78190 Details
Description
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE_CGI_AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity_encode method with one that returns its input unchanged, so enabling WEBDYNE_CGI_AUTOESCAPE has no effect. A remote attacker can inject script into any page using these tags through a crafted link.
A cross-site scripting vulnerability has been identified in WebDyne versions 2.014 prior to 3.022. The issue arises because the application reflects request parameters into form field values without proper escaping. This flaw allows remote attackers to inject scripts into any page using text fields, password fields, or file fields. The vulnerability is exacerbated by the default setting of the WEBDYNE_CGI_AUTOESCAPE variable, which is 'off'. In WebDyne version 2.022, the HTML entity encoding method was changed to return input unmodified, rendering the WEBDYNE_CGI_AUTOESCAPE setting ineffective.
Users can upgrade to WebDyne version 3.022 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 31, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://metacpan.org/release/ASPEER/WebDyne-3.022/changes | CPANSec | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CPANSec |
Affected Products
| Product | Versions |
|---|---|
| WebDyne | >= 2.014, < 3.022 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Oct 31, 2026 | New CVE Received | CPANSec |