CVE-2026-78838 is a reflected XSS vulnerability affecting the grid_datasource.php component of AppNitro MachForm version 30. The vulnerability arises from improper sanitization of user input in the filter[filters][0][field] parameter, enabling attackers to inject malicious JavaScript that executes in the victim's browser context. This can lead to potential session hijacking, defacement, or other client-side attacks depending on the injected script. No CVSS score or detailed vendor advisory is available, and no patch or mitigation has been confirmed.

Successful exploitation allows execution of arbitrary JavaScript in the victim's browser, which can lead to theft of sensitive information, session hijacking, or other malicious actions performed on behalf of the user. The impact is limited to client-side attacks within the context of the vulnerable web application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying input validation or filtering at the web application firewall level to block malicious payloads targeting the filter[filters][0][field] parameter.