Quick answers
- Is CVE-2026-78190 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-78190 being exploited in the wild.
- How severe is CVE-2026-78190?
- Informational severity, published 31 October 2026.
- Which products and versions are affected?
- ASPEER WebDyne 2.014 to 3.021.
- Is there a fix for CVE-2026-78190?
- Yes: fixed in WebDyne 3.022. Until then: Enable WEBDYNE_CGI_AUTOESCAPE in your configuration; however, this has no effect in versions 2.022–3.021 due to the broken entity encoder. Upgrade to WebDyne 3.022 or later, which restores proper escaping and re-enables it by default. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-78190 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-78190?
- Check whether you run ASPEER WebDyne at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: WebDyne 3.022
Enable WEBDYNE_CGI_AUTOESCAPE in your configuration; however, this has no effect in versions 2.022–3.021 due to the broken entity encoder. Upgrade to WebDyne 3.022 or later, which restores proper escaping and re-enables it by default.
Technical details
The vulnerability exists in WebDyne's textfield, password_field, and filefield tags, which populate the HTML value attribute directly from request parameters. The WEBDYNE_CGI_AUTOESCAPE option that should escape these values defaults to off; additionally, from version 2.022, the entity_encode method was broken and returns input unchanged, defeating escaping even when enabled. A remote attacker can inject arbitrary HTML and JavaScript through a crafted link targeting any page using these tags.
Affected products
- ASPEER WebDyne 2.014 to 3.021
Timeline
- 2026-10-31: disclosed