CVE-2026-78190: WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting.

The textfield, passwordfield and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNECGIAUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entityencode method with one that returns its input unchanged, so enabling WEBDYNECGIAUTOESCAPE has no effect.

A remote attacker can inject script into any page using these tags through a crafted link.