CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting.

The textfield, password field and filefield tags fill their value attribute from the request parameter of the same name. WEBDYNE CGI AUTOESCAPE, which controls escaping of these values, defaults to off. From 2.022, WebDyne::HTML::Tiny also replaced its entity encode method with one that returns its input unchanged, so enabling WEBDYNE CGI AUTOESCAPE has no effect.

A remote attacker can inject script into any page using these tags through a crafted link.