# CVE-2026-78190: WebDyne reflected XSS via unescaped form field values

Source: https://junglewise.ai/threats/cve-2026-78190-webdyne-versions-from-2-014-before-3-022-for-perl-reflect-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-78190 · Severity: info · Published 2026-10-31

WebDyne is a Perl-based web application framework that renders dynamic web pages. Versions 2.014 through 3.021 contain a cross-site scripting vulnerability where request parameters are inserted unescaped into HTML form field values, allowing attackers to inject malicious script code through crafted URLs. An attacker can use this to steal session tokens, hijack user accounts, or deface pages.

Technologies: [ASPEER WebDyne](https://junglewise.ai/threats/technologies/webdyne). Vendors: [ASPEER](https://junglewise.ai/threats/vendors/aspeer).

## Quick answers

**Is CVE-2026-78190 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78190 being exploited in the wild.

**How severe is CVE-2026-78190?** Informational severity, published 31 October 2026.

**Which products and versions are affected?** ASPEER WebDyne 2.014 to 3.021.

**Is there a fix for CVE-2026-78190?** Yes: fixed in WebDyne 3.022. Until then: Enable WEBDYNE_CGI_AUTOESCAPE in your configuration; however, this has no effect in versions 2.022–3.021 due to the broken entity encoder. Upgrade to WebDyne 3.022 or later, which restores proper escaping and re-enables it by default. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-78190 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-78190?** Check whether you run ASPEER WebDyne at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in WebDyne 3.022

Enable WEBDYNE_CGI_AUTOESCAPE in your configuration; however, this has no effect in versions 2.022–3.021 due to the broken entity encoder. Upgrade to WebDyne 3.022 or later, which restores proper escaping and re-enables it by default.

## Technical details

The vulnerability exists in WebDyne's textfield, password_field, and filefield tags, which populate the HTML value attribute directly from request parameters. The WEBDYNE_CGI_AUTOESCAPE option that should escape these values defaults to off; additionally, from version 2.022, the entity_encode method was broken and returns input unchanged, defeating escaping even when enabled. A remote attacker can inject arbitrary HTML and JavaScript through a crafted link targeting any page using these tags.

## Affected products

- ASPEER WebDyne 2.014 to 3.021

## Timeline

- 2026-10-31: disclosed

## References

- [https://cpan.org/modules](https://cpan.org/modules)
- [https://metacpan.org/release/ASPEER/WebDyne-3.022/changes](https://metacpan.org/release/ASPEER/WebDyne-3.022/changes)

## Related threats

- [WebDyne source code disclosure via default index viewer](https://junglewise.ai/threats/cve-2026-78192-webdyne-versions-from-2-022-before-3-022-for-perl-disclose)
- [WebDyne PSP extension matching regex remote code execution](https://junglewise.ai/threats/cve-2026-78191-webdyne-versions-from-2-031-before-3-022-for-perl-execute-files)
- [WebDyne path traversal in PSGI API route fallback](https://junglewise.ai/threats/cve-2026-78189-webdyne-versions-from-3-007-before-3-022-for-perl-execute-psp)
- [WebDyne session cookie missing Secure, HttpOnly, SameSite attributes](https://junglewise.ai/threats/cve-2026-78188-webdyne-versions-from-2-014-before-3-022-for-perl-issue-session)