CVE-2026-51153

Name of the Vulnerable Software and Affected Versions QD versions 20220208 through 20250803

Description Stored Cross-Site Scripting (XSS) occurs in the TaskRunHandler.post() function within web/handlers/task.py. When a task is executed via the '/task//run' endpoint, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without proper HTML encoding. The logtmp variable is populated from the exception object or from new env.variables. log , which can be controlled by an attacker through the template extract variables mechanism. A low-privileged authenticated attacker can use the 'api://util/unicode' endpoint to create a crafted HAR template that injects arbitrary HTML or JavaScript into the log variable. This script then executes in the browser of a victim who triggers the task run within the application context.

Recommendations Update QD to a version later than 20250803. As a temporary mitigation, restrict access to the 'api://util/unicode' endpoint and the '/task//run' endpoint to trusted users only.