Input Neutralization Issue in Crafty Controller by Crafty Technologies
CVE-2026-90821

5.4MEDIUM

Key Information:

Vendor

Arcadia Technology, Llc

Status
Crafty Controller
Vendor
CVE Published:
16 October 2026

What is CVE-2026-90821?

An input neutralization issue in the Webhook URL form field of Crafty Controller permits a remote, authenticated attacker to execute stored cross-site scripting (XSS) attacks by supplying malicious input in web forms. This vulnerability underscores the importance of robust input validation mechanisms to prevent unauthorized script execution and protect web applications from potential exploitation.

Affected Version(s)

Crafty Controller 4.2.0 < 4.11.0

References

https://gitlab.com/crafty-controller/crafty-4/-/work_item...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thank you to [Kacper Leszczyński / szotgan](https://gitlab.com/szotgan) on GitLab for reporting this issue.
.