CVE-2026-90492

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0

Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen() and controller recover() functions located in the py/web.py file.

Recommendations As a temporary workaround, restrict access to the controller listen() and controller recover() functions in the py/web.py file. Avoid using the case name argument in the affected functions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.