CVE-2026-90528

Name of the Vulnerable Software and Affected Versions TDuckApp tduck-platform versions prior to 5.4

Description A flaw in the Form Write View component, specifically within the file tduck-front/src/views/form/write/index.vue, allows for remote cross-site scripting. This occurs through the manipulation of the submitShowCustomPageContent argument. Cross-site scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.