CVE-2026-51153: QD Stored Cross-Site Scripting Vulnerability

CVE-2026-51153 Overview

CVE-2026-51153 is a stored Cross-Site Scripting (XSS) vulnerability in the QD task automation platform. The flaw resides in TaskRunHandler.post() within web/handlers/task.py and affects QD versions 20220208 through 20250803. The handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. A low-privileged authenticated attacker can craft a HAR template that extracts arbitrary HTML or JavaScript into the __log__ variable through the api://util/unicode endpoint. When a victim triggers the task run, the injected script executes in the victim's browser within the QD application context [CWE-79].

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in victim browsers, enabling session theft, credential harvesting, and unauthorized actions within the QD application context.

Affected Products

QD (qd-today) versions 20220208 through 20250803
Component: web/handlers/task.py (TaskRunHandler.post())
Endpoint: /task/<taskid>/run

Discovery Timeline

2026-08-31 - CVE-2026-51153 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-51153

Vulnerability Analysis

The vulnerability exists in QD's task execution handler, which processes HTTP archive (HAR) templates and returns task run results as HTML. When a task executes at /task/<taskid>/run, TaskRunHandler.post() constructs the HTML response by inserting the log buffer logtmp through Python's % string formatting operator. This substitution occurs without any HTML entity encoding or output sanitization, allowing raw HTML markup and JavaScript to reach the DOM.

The logtmp value derives from two attacker-influenced sources: exception messages generated during template evaluation and the new_env.variables.__log__ variable set through the template's extract_variables mechanism. Because a low-privileged authenticated user can author HAR templates and populate __log__ with arbitrary strings via the api://util/unicode endpoint, the log content becomes a stored injection sink.

Root Cause

The root cause is missing output encoding when server-side data is composed into an HTML response. Python % formatting performs a simple string substitution and does not treat the substituted content as HTML-sensitive. The handler treats logtmp as trusted internal state despite it being sourced from user-controlled template execution.

Attack Vector

Exploitation requires an authenticated account with permission to create or modify task templates. The attacker crafts a HAR template that uses extract_variables and the api://util/unicode endpoint to write a JavaScript payload into __log__. When a victim, typically another authenticated user or administrator, triggers the task run, the server renders the payload into the response and the browser executes it under the QD origin. This satisfies the CVSS scope change condition because the injected script inherits the victim's session context. See the GitHub Gist PoC Repository for the published proof of concept.

Refer to the QD Today Security Blog and the linked PoC for the full template structure and injection payload.

Detection Methods for CVE-2026-51153

Indicators of Compromise

HAR templates authored by low-privileged accounts that contain extract_variables entries writing to __log__.
Requests to api://util/unicode returning payloads containing HTML tags such as <script>, <img onerror=...>, or <svg onload=...>.
POST requests to /task/<taskid>/run where the rendered response body contains executable script tags originating from log content.
Anomalous outbound requests from user browsers to attacker-controlled hosts shortly after opening a task run page.

Detection Strategies

Inspect stored task templates for __log__ assignments containing angle brackets, event handler attributes, or JavaScript URIs.
Deploy a Content Security Policy (CSP) in report-only mode and alert on inline script violations from /task/*/run responses.
Correlate template modification events with subsequent task-run responses to identify templates that inject markup into log output.

Monitoring Recommendations

Enable verbose access logging on the /task/<taskid>/run route and archive request bodies and rendered responses.
Monitor authenticated user actions creating or updating templates and flag templates that invoke api://util/unicode with HTML-like content.
Alert on browser telemetry showing script execution on QD pages that references untrusted domains.

How to Mitigate CVE-2026-51153

Immediate Actions Required

Restrict template creation and modification privileges to trusted administrators until a patch is applied.
Audit existing HAR templates for __log__ assignments and remove any containing HTML or script content.
Deploy a strict Content Security Policy that blocks inline scripts on QD application pages.

Patch Information

At the time of publication, no vendor patch reference is included in the NVD entry. Monitor the QD Today Security Blog and the QD project repository for a fixed release beyond version 20250803. Apply the fix that replaces Python % string formatting in TaskRunHandler.post() with HTML-escaped rendering, for example using html.escape() or a templating engine with autoescaping enabled.

Workarounds

Apply web application firewall (WAF) rules that strip or block HTML markup in responses from /task/<taskid>/run.
Disable or gate access to the api://util/unicode endpoint for non-administrative accounts.
Enforce role separation so users who can author templates cannot share tasks with higher-privileged reviewers.

bash

# Example CSP header to reduce XSS impact until patched
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'