The vulnerability resides in Industrial Edge App Publisher versions older than 1.27.9, where data received from the backend is rendered in the user interface without proper sanitization or escaping. The front end is built with Node.js, enabling the injection of arbitrary JavaScript that executes in the victim’s browser context. The ability to execute arbitrary code can lead to full control over the victim’s machine and compromise confidentiality, integrity, and availability of the managed edge device.

Siemens Industrial Edge App Publisher is affected. All exposed instances running any version prior to 1.27.9 are vulnerable. The attack surface includes any system that provides data to the front‑end UI of the application.

With a CVSS score of 7.7, the vulnerability presents moderate to high severity. The EPSS score is not available, so the likelihood of exploitation is unknown, but the absence of a KEV listing suggests no widespread exploitation yet. The integrated Node.js runtime and lack of output encoding provide a clear path for an attacker to craft malicious payloads, making exploitation feasible if an attacker can influence backend responses or inject content.