A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. (CVE-2026-90492)
A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py/web.py. The manipulation of the argument case_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AI Analysis
Technical Summary
CVE-2026-90492 is an OS command injection vulnerability in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0. The vulnerability arises from improper handling of the argument case_name in the controller_listen/controller_recover functions of the py/web.py file. An attacker can remotely manipulate this argument to execute arbitrary OS commands. The vulnerability has been publicly disclosed, and no vendor response or patch is currently available.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This could compromise system stability and data security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should consider applying workarounds such as restricting access to the vulnerable functions or input validation on the case_name argument until an official fix is released.
A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. (CVE-2026-90492)
Description
A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/controller_recover of the file py/web.py. The manipulation of the argument case_name leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS v3.1
Score 6.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90492 is an OS command injection vulnerability in webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0. The vulnerability arises from improper handling of the argument case_name in the controller_listen/controller_recover functions of the py/web.py file. An attacker can remotely manipulate this argument to execute arbitrary OS commands. The vulnerability has been publicly disclosed, and no vendor response or patch is currently available.
Potential Impact
Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system, potentially leading to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). This could compromise system stability and data security.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should consider applying workarounds such as restricting access to the vulnerable functions or input validation on the case_name argument until an official fix is released.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ff59-mhrh-hcvf
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90492"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa741ab55bf5e2cf548a60e
Added to database: 09/14/2026, 00:36:59 UTC
Last enriched: 09/14/2026, 00:44:44 UTC
Last updated: 09/14/2026, 04:01:22 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.