The vulnerability CVE-2026-90492 affects webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0. It is an OS command injection issue in the controller_listen and controller_recover functions within py/web.py. By manipulating the case_name argument, an attacker can remotely execute arbitrary operating system commands. The vulnerability has been publicly disclosed with exploit code available, and the vendor has not responded to the disclosure.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected system with no privileges required and no user interaction needed. This can lead to system compromise or unauthorized control of the affected host. The CVSS 4.0 base score is 5.3, indicating medium severity with low confidentiality, integrity, and availability impact but with potential for partial system control.

No official patch or remediation is currently available from the vendor, as they have not responded to the disclosure. Users should monitor the vendor's channels for updates. Until a fix is released, consider restricting access to the vulnerable functions or deploying network-level controls to limit exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.