CVE-2026-78557: XSS
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Industrial Edge App Publisherto a version that resolves this vulnerability.Fixed in V1.27.9
Event History
Frequently Asked Questions
Which versions should be prioritized for remediation?
All Siemens Industrial Edge App Publisher versions earlier than V1.27.9 are affected. Upgrade to V1.27.9 or later.
What must occur for exploitation to succeed?
An attacker must cause unsanitized backend-provided data to be rendered in the application's user interface. Exploitation also requires user interaction, as indicated by the UI:R attack vector.
What is the potential impact on an affected user machine?
The injected content can execute arbitrary JavaScript in the integrated Node.js front end. This can be leveraged to achieve remote code execution on the victim's machine, with high confidentiality, integrity, and availability impact.