CVE-2026-45228 is a stored cross-site scripting vulnerability in Cp0204's quark-auto-save product, specifically in Quark Drive versions before 0.8.5. The issue occurs because the System Configuration page renders push_config key names using Vue.js's v-html directive without escaping input. Authenticated users can exploit this by injecting malicious HTML or JavaScript payloads through the POST /update endpoint. These payloads persist on disk and execute in the context of other authenticated users viewing the System Configuration tab, enabling session cookie exfiltration and arbitrary authenticated actions.

Successful exploitation allows authenticated attackers to execute arbitrary JavaScript in the browsers of other authenticated users. This can lead to session cookie theft and unauthorized actions performed with the victim's privileges within the application. The vulnerability affects confidentiality and integrity of user sessions but requires attacker authentication and user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the System Configuration page to trusted users only and monitor for suspicious activity. Avoid using untrusted input in contexts rendered with v-html or similar directives without proper escaping.