CVE-2026-51153

MediumCVSS 5.4

Published: 31/08/2026(UTC)Updated: 01/09/2026(UTC)Translated: 31/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

Stored Cross-Site Scripting (XSS) vulnerability in TaskRunHandler.post() in web/handlers/task.py in QD. When a task is run via /task/<taskid>/run, task log content is rendered into the HTML response without HTML encoding, allowing a low-privileged attacker to inject malicious script.

Risk Assessment

An attacker can execute arbitrary script in the victim's browser within the QD application context, potentially leading to session theft, data modification, or other malicious actions.

Recommendation

Immediately update QD to a version that HTML-encodes rendered logs and validates input in the extract_variables mechanism.

Other vulnerabilities in QD

CVE-2026-51152Critical
Server-side request forgery (SSRF) vulnerability in the /har/test endpoint in QD. Fetcher.build_request() constructs an HTTP request from user-supplied data without validating URL scheme, host, or IP range, and the endpoint does not require authentication.

Original NVD description (English source)

Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.