CVE-2026-90528: TDuckApp tduck-platform XSS Vulnerability

CVE-2026-90528 Overview

CVE-2026-90528 is a cross-site scripting (XSS) vulnerability affecting TDuckApp tduck-platform versions up to 5.3. The flaw resides in the Form Write View component, specifically within the tduck-front/src/views/form/write/index.vue file. Attackers can manipulate the submitShowCustomPageContent argument to inject arbitrary script content that executes in the context of other users' browsers. The issue is remotely exploitable and requires low privileges combined with user interaction. According to VulDB, the maintainers were notified through an issue report but have not responded at the time of publication.

Critical Impact
Authenticated attackers can inject script payloads through the submitShowCustomPageContent parameter to steal session data, hijack accounts, or perform actions on behalf of victims interacting with affected forms.

Affected Products

TDuckApp tduck-platform up to and including version 5.3
Component: Form Write View (tduck-front/src/views/form/write/index.vue)
Deployments exposing form authoring or submission views to untrusted users

Discovery Timeline

2026-09-13 - CVE-2026-90528 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90528

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting weakness classified under [CWE-79]. It exists in the front-end Vue component tduck-front/src/views/form/write/index.vue, which handles rendering of custom page content during form submission workflows. The submitShowCustomPageContent argument is not properly sanitized or encoded before being incorporated into the DOM. When a victim loads a form that includes attacker-controlled content, the injected JavaScript executes with the victim's privileges within the application. The attack requires network access to the affected form functionality and interaction from a legitimate user.

Root Cause

The root cause is missing output encoding and inadequate input validation on the submitShowCustomPageContent value. The Vue template likely renders the parameter via a mechanism such as v-html, which interprets the string as raw HTML rather than treating it as inert text. This design choice allows any embedded <script> tags, event handlers, or JavaScript URIs to be parsed and executed by the browser.

Attack Vector

An authenticated attacker with the ability to author or submit form content injects a crafted payload into the submitShowCustomPageContent field. When another user renders the affected form view, the payload executes in that user's browser session. Typical attack outcomes include session token theft, credential harvesting via injected phishing overlays, and unauthorized API calls against the TDuck platform on behalf of the victim. See the Gitee TDuck Platform Issue #IK5RJD and VulDB CVE-2026-90528 entry for additional technical detail.

Detection Methods for CVE-2026-90528

Indicators of Compromise

HTTP requests to form submission endpoints containing <script>, javascript:, or event-handler payloads within the submitShowCustomPageContent parameter
Unexpected outbound requests from user browsers to attacker-controlled domains following form rendering
Anomalous session activity or API calls originating from authenticated users shortly after accessing custom form pages

Detection Strategies

Inspect stored form records in the TDuck database for HTML or JavaScript fragments in fields that should contain plain text
Deploy web application firewall rules that flag XSS payload patterns targeting /form/write/ endpoints
Review browser Content Security Policy (CSP) violation reports for inline script executions on TDuck pages

Monitoring Recommendations

Enable verbose HTTP access logging on the TDuck front-end and back-end services with parameter capture
Correlate form submission events with subsequent authentication or privilege-change events to detect account takeover
Monitor for repeated form submissions from a single low-privilege account that contain HTML-encoded or obfuscated payloads

How to Mitigate CVE-2026-90528

Immediate Actions Required

Restrict access to the form authoring and submission functionality to trusted users until a vendor patch is available
Deploy a web application firewall with XSS filtering in front of the TDuck platform
Enforce a strict Content Security Policy that disallows inline scripts and untrusted script sources
Audit existing form records for stored payloads and sanitize or remove suspicious entries

Patch Information

No official patch is available at the time of publication. The project was informed through an issue report but has not responded. Monitor the Gitee TDuck Platform Repository and the VulDB Vulnerability #403118 entry for updates on remediation.

Workarounds

Apply a reverse-proxy rule to strip or HTML-encode angle brackets and event handlers from the submitShowCustomPageContent parameter
Configure the application to render user-supplied form content as text rather than HTML by replacing v-html bindings with v-text or {{ }} interpolation in local builds
Isolate the TDuck platform behind SSO with strong authentication to limit the pool of accounts able to submit form content
Educate form reviewers to open submissions in sandboxed browser profiles when possible

bash

# Example NGINX rule to block obvious XSS payloads on the form endpoint
location /form/write/ {
    if ($args ~* "(<script|javascript:|onerror=|onload=)") {
        return 403;
    }
    proxy_pass http://tduck_backend;
}