CVE-2026-78557

HighCVSS 8.3

Published: 13/10/2026(UTC)Updated: 15/10/2026(UTC)Translated: 13/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

38th percentile - higher than 38% of all known CVEs

Summary

A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of sanitization of data received from the backend before rendering in the user interface. Because the front end is integrated with Node.js, this allows execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine.

Risk Assessment

The risk includes the possibility of remote code execution on the victim's machine, potentially leading to full system and data compromise.

Recommendation

Update to version V1.27.9 or later and implement proper input sanitization in the user interface.

Other vulnerabilities in Industrial Edge App Publisher

CVE-2026-78556High
A vulnerability in Industrial Edge App Publisher (versions < V1.27.9) is due to lack of server certificate validation when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity.

Original NVD description (English source)

A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine

Vulnerability data from NVD (NIST) · CISA KEV · EPSS