Threats affecting pkg:pypi/webgjc/web-robot

CVE-2026-90492 is a medium severity OS command injection vulnerability in the webgjc web_robot product affecting versions 2.4.0, 2.5.0, and 2.8.0. The flaw exists in the controller_listen and controller_recover functions within the py/web.py file, where manipulation of the case_name argument allows remote attackers to inject OS commands. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.