CVE-2026-78557

Siemens Industrial Edge App Publisher versions before V1.27.9 fail to sanitize or escape data received from the backend before rendering it in the user interface (CWE-79). Because the front end is integrated with Node.js, injected content can run as arbitrary JavaScript on the victim's machine and be leveraged for remote code execution. An attacker can reach the flaw over the network without prior privileges, but user interaction and other attack requirements apply, and a successful attack can fully compromise confidentiality, integrity, and availability of the publisher host. The issue affects all Industrial Edge App Publisher releases older than V1.27.9. It is not listed in CISA KEV, and no public proof-of-concept or in-the-wild exploitation is known.

What to do: Upgrade Siemens Industrial Edge App Publisher to V1.27.9 or later. Until then, avoid using the publisher against untrusted or compromised backends, and treat any unexpected UI content or script behavior as a possible compromise of the workstation.