Kurokoleung

**Name of the Vulnerable Software and Affected Versions** QD versions 20220208 through 20250803 **Description** Stored Cross-Site Scripting (XSS) occurs in the `TaskRunHandler.post()` function within `web/handlers/task.py`. When a task is executed via the '/task/<taskid>/run' endpoint, the handler renders task log content (`logtmp`) into the HTML response using Python % string formatting without proper HTML encoding. The `logtmp` variable is populated from the exception object or from `new env.variables. log `, which can be controlled by an attacker through the template `extract variables` mechanism. A low-privileged authenticated attacker can use the 'api://util/unicode' endpoint to create a crafted HAR template that injects arbitrary HTML or JavaScript into the ` log ` variable. This script then executes in the browser of a victim who triggers the task run within the application context. **Recommendations** Update QD to a version later than 20250803. As a temporary mitigation, restrict access to the 'api://util/unicode' endpoint and the '/task/<taskid>/run' endpoint to trusted users only.