CVE-2026-78557: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Siemens Industrial Edge App Publisher

The Industrial Edge App Publisher from Siemens contains an improper input neutralization vulnerability (CWE-79) affecting all versions before 1.27.9. The frontend fails to sanitize or escape data received from the backend, enabling execution of arbitrary JavaScript within the user interface. Because the frontend uses Node.js, exploitation can escalate to remote code execution on the victim system. The CVSS 3.1 base score is 8.3, reflecting high impact on confidentiality, integrity, and availability with network attack vector, high attack complexity, no privileges required, and user interaction needed.

Successful exploitation can lead to execution of arbitrary JavaScript code in the context of the vulnerable application, which may escalate to remote code execution on the victim's machine. This compromises confidentiality, integrity, and availability of the affected system.

A fixed version 1.27.9 or later is implied but no explicit patch link or vendor advisory is provided. Users should upgrade to Industrial Edge App Publisher version 1.27.9 or later once available. Until then, apply any recommended vendor mitigations if provided. Patch status is not yet confirmed — check Siemens' official advisory for current remediation guidance.