CVE-2026-45228 is a stored cross-site scripting vulnerability in the Cp0204 quark-auto-save product (Quark Drive) affecting versions before 0.8.5. The issue occurs because the System Configuration page renders push_config key names using Vue.js's v-html directive without escaping input, allowing authenticated attackers to inject malicious HTML or JavaScript via the POST /update endpoint. The injected code is persisted and executed in the context of authenticated users viewing the System Configuration tab, enabling session cookie exfiltration and arbitrary authenticated actions. The CVSS 4.0 base score is 5.1, indicating a medium severity vulnerability. No official patch or remediation level is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript in the browsers of other authenticated users accessing the System Configuration page. This can lead to session cookie theft and unauthorized actions performed with the victim's privileges. The vulnerability affects confidentiality and integrity of user sessions within the application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the System Configuration page to trusted users only and consider additional input validation or output encoding controls if possible. Monitor vendor channels for updates regarding a fix.