CVE-2026-90492: webgjc web_robot OS Command Injection RCE

CVE-2026-90492 Overview

CVE-2026-90492 is an operating system command injection vulnerability affecting webgjc web_robot versions 2.4.0, 2.5.0, and 2.8.0. The flaw resides in the controller_listen and controller_recover functions within py/web.py. Attackers can manipulate the case_name argument to inject arbitrary operating system commands. The attack is executable remotely across the network and requires user interaction to succeed. Public exploit disclosure has occurred, and the vendor was contacted about this issue but did not respond, leaving affected deployments without an official patch. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command.

Critical Impact
Remote attackers can inject operating system commands through the case_name parameter, potentially compromising confidentiality, integrity, and availability of the host running web_robot.

Affected Products

webgjc web_robot 2.4.0
webgjc web_robot 2.5.0
webgjc web_robot 2.8.0

Discovery Timeline

2026-09-13 - CVE-2026-90492 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90492

Vulnerability Analysis

The vulnerability exists in the py/web.py module of webgjc web_robot. Two controller functions, controller_listen and controller_recover, accept a case_name parameter from user-supplied input. The parameter value is passed to an operating system command execution routine without sufficient sanitization or neutralization of shell metacharacters. An attacker who supplies crafted input containing shell separators or command substitution syntax can cause the underlying interpreter to execute injected commands with the privileges of the web_robot process.

Exploitation requires user interaction according to the CVSS 4.0 vector, which limits fully unauthenticated automated attacks but still permits phishing-style delivery of malicious links or requests. A public exploit disclosure exists per the VulDB entry. The EPSS probability is 1.513% at the 73.3 percentile as of 2026-09-20.

Root Cause

The root cause is improper neutralization of special elements used in an operating system command [CWE-77]. The case_name argument is concatenated into or passed to a shell command without escaping shell metacharacters such as ;, |, &, $(), or backticks. Because the value originates from remote HTTP input, any injected content is executed by the underlying shell interpreter invoked by the Python process.

Attack Vector

The attack vector is network-based. An adversary crafts an HTTP request that targets an endpoint routed to controller_listen or controller_recover and places command-injection payloads in the case_name parameter. When a user interacts with the crafted request, the vulnerable controller executes the payload on the server. No authentication is required. Consult the VulDB CVE-2026-90492 entry for additional technical context.

Detection Methods for CVE-2026-90492

Indicators of Compromise

Web server access logs containing shell metacharacters (;, |, &, $(), backticks) inside the case_name request parameter.
Unexpected child processes spawned by the Python interpreter hosting web_robot, particularly shells such as /bin/sh, /bin/bash, or cmd.exe.
Outbound network connections originating from the web_robot process to unfamiliar external hosts.
New or modified files in web-accessible directories following requests to controller_listen or controller_recover.

Detection Strategies

Inspect HTTP request bodies and query strings for command-injection patterns targeting the case_name parameter and alert on shell metacharacter presence.
Deploy process ancestry monitoring to flag shell invocations whose parent process is the web_robot Python service.
Correlate web request telemetry with endpoint process telemetry to link inbound HTTP payloads to spawned commands.

Monitoring Recommendations

Enable verbose access logging on the web_robot service and forward logs to a centralized analytics platform for retention and query.
Monitor for anomalous outbound network flows from application servers running web_robot.
Track file integrity on the py/web.py module and its enclosing directory to identify tampering.

How to Mitigate CVE-2026-90492

Immediate Actions Required

Restrict network exposure of web_robot by placing the service behind an authenticated reverse proxy or virtual private network.
Deploy a web application firewall rule that blocks requests containing shell metacharacters in the case_name parameter.
Run the web_robot service under a low-privilege operating system account to limit the blast radius of command execution.
Audit application and system logs for prior exploitation attempts against controller_listen and controller_recover.

Patch Information

The vendor did not respond to disclosure attempts, and no official patch is available at the time of publication. Operators should track the VulDB advisory for updates. If source access is available, apply local patches that validate case_name against an allowlist of expected characters and replace shell-based command execution with argument-array invocations that do not invoke a shell interpreter.

Workarounds

Filter incoming case_name values against a strict allowlist regular expression such as ^[A-Za-z0-9_-]+$ before passing them to backend logic.
Remove or comment out the controller_listen and controller_recover routes if they are not required in the deployment.
Isolate the web_robot host within a segmented network zone with egress filtering to prevent post-exploitation callbacks.

bash

# Example nginx rule to block shell metacharacters in case_name
if ($arg_case_name ~* "[;&|`$()<>\\]") {
    return 403;
}