Edge App Publisher CVE-2026-78557

Exploitation requires (1) that the attacker can control or influence data returned by the Industrial Edge backend that the App Publisher client subsequently renders, and (2) that a victim actively uses the affected Industrial Edge App Publisher client (all versions below V1.27.9) to view that data - reflected by UI:P and AT:P in the CVSS 4.0 vector. The flaw stems specifically from the front end failing to sanitize/escape backend-supplied data before rendering, combined with the client's Node.js integration that allows injected JavaScript to escalate to OS-level RCE. Limiting factors: the victim must run a vulnerable client version, user interaction/presence is needed, and the attacker must first achieve a position to inject or manipulate backend-delivered data - this is not direct exploitation of an exposed listening service, so it favors targeted scenarios over opportunistic mass exploitation.

This is a moderate-priority issue whose real-world risk is tempered by several limiting conditions rather than a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H) scores 7.7 (High) and reflects a network-reachable, unauthenticated flaw (PR:N) with full confidentiality/integrity/availability impact on the vulnerable system via XSS-to-RCE in a Node.js-integrated front end - but it also carries AT:P (a specific attack requirement, i.e. the attacker must get malicious data into the backend that the client renders) and UI:P (the victim must be running/using the App Publisher client). No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of a client-side tool, required victim interaction, and an attacker-controlled-backend precondition means this is most realistic as a targeted attack (e.g. a compromised or malicious Industrial Edge backend serving crafted data to engineers) rather than mass internet-wide exploitation. Note a signal to verify: the vector is AV:N yet the impact lands as RCE on the victim's local engineering workstation - the 'network' vector refers to the data channel from backend to client, not direct remote takeover of an exposed service, which defenders should keep in mind when prioritizing.

An attacker who can influence data returned by an Industrial Edge backend (for example via a compromised or rogue backend, or by injecting malicious app/project metadata) crafts a payload containing unescaped HTML/JavaScript. When an engineer opens or refreshes the affected view in the Industrial Edge App Publisher client, the unsanitized data is rendered and the injected JavaScript executes; because the front end is integrated with Node.js, this escalates from browser-context XSS to arbitrary code execution on the engineer's workstation. No public proof-of-concept was provided in the input.