CVE-2026-51153

Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.

• CWE-79

• https://gist.github.com/kurokoleung/9fc51b02c85c2f466bf4ea72c62ba343
• https://qd-today.github.io/qd/

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-51133Cross Site Scripting vulnerability in za-internet GmbH C-MOR…6.1
• CVE-2026-51134The C-MOR Video Surveillance web interface (up to version 6.…7.5
• CVE-2026-5114The SpeedyCache plugin for WordPress is vulnerable to Arbitr…4.9
• CVE-2026-51144Cross Site Scripting vulnerability in Soliton Systems MailZe…6.1
• CVE-2026-5115The PaperCut NG/MF (specifically, the embedded application f…7.5
• CVE-2026-51152Server-side request forgery (SSRF) in the /har/test endpoint…9.1
• CVE-2026-5116The Contact Form 7 – Dynamic Text Extension plugin for WordP…4.4
• CVE-2026-5118The Divi Form Builder plugin for WordPress is vulnerable to …9.8
• CVE-2026-5119A flaw was found in libsoup. When establishing HTTPS tunnels…8.2
• CVE-2026-51190The "s init" command in Serverless-Devs @serverless-devs/s <…9.8
• CVE-2026-5120A Race Condition vulnerability affecting BIOVIA Workbook fro…8.1
• CVE-2026-5121A flaw was found in libarchive. On 32-bit systems, an intege…7.5