CVE-2026-51153 in QD
Summary
by MITRE • 08/31/2026
Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/31/2026
The vulnerability identified is a Stored Cross-Site Scripting (XSS) flaw located within the TaskRunHandler.post() method of the web/handlers/task.py module in versions 20220208 through 20250803. This security defect arises from improper neutralization of special elements used in an HTML context, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. The core technical failure occurs when the application renders task log content into an HTML response using Python string formatting operators without applying any form of HTML encoding or escaping. This lack of sanitization allows maliciously crafted input to be interpreted as executable code by the victim's web browser rather than being displayed as plain text data.
The attack vector relies on the attacker controlling the source of the log content, which is populated from either an exception object or a variable named _log_ within new_env.variables. This control is achieved through the template extract_variables mechanism, which permits low-privileged authenticated users to inject arbitrary HTML and JavaScript payloads into these variables. Specifically, attackers can utilize the api://util/unicode endpoint via crafted HAR templates to insert malicious scripts directly into the log stream. Because this data is stored within the application's context before being rendered in subsequent requests, it constitutes a persistent or stored XSS vulnerability rather than a reflected one.
The operational impact of this vulnerability is significant for any organization relying on the affected software version. A low-privileged authenticated attacker can create a task configuration that embeds malicious JavaScript code into the log output. When another user with higher privileges or different permissions triggers the execution of this task, their browser will parse and execute the embedded script within the security context of the QD application. This enables session hijacking, where an attacker can steal authentication cookies or tokens to impersonate the victim. It also facilitates credential harvesting through fake login forms injected into the page, defacement of the user interface, and potentially further network pivoting if the browser has access to internal resources not protected by cross-origin policies.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary fix involves implementing strict output encoding for all dynamic content rendered in HTML contexts. Developers should utilize established templating engine features that automatically escape variables or apply explicit HTML entity encoding functions before inserting log data into the response body. Additionally, deploying a Content Security Policy (CSP) header can mitigate the impact of any remaining XSS vulnerabilities by restricting the sources from which scripts are allowed to execute. Regular security code reviews focusing on input validation and output sanitization patterns are essential to prevent similar flaws in other parts of the application lifecycle.
From an offensive security perspective, this vulnerability aligns with MITRE ATT&CK technique T1059.007: Command and Scripting Interpreter::JavaScript, as it involves executing JavaScript code within a victim's browser environment. It also relates to T1189: Drive-by Client Side Execution, where the execution is triggered by user interaction with a compromised application state. Understanding these mappings helps in prioritizing remediation efforts based on the potential for lateral movement and privilege escalation within the target infrastructure.