CVE-2026-51153: n/a

This vulnerability exists in the QD application's TaskRunHandler.post() method, where task log content (logtmp) is inserted into HTML responses using Python % string formatting without HTML encoding. The log content can be influenced by an attacker via the template extract_variables mechanism, specifically through the api://util/unicode endpoint, allowing injection of arbitrary HTML or JavaScript. This results in stored cross-site scripting that executes in the context of the victim's browser when they trigger the affected task run endpoint. The vulnerability affects versions from 20220208 through 20250803. The CVSS 3.1 base score is 5.4, indicating medium severity, with network attack vector, low attack complexity, low privileges required, and user interaction needed.

Successful exploitation allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript in the context of other users' browsers within the QD application. This can lead to information disclosure and integrity impacts by executing malicious scripts, but does not affect availability. The vulnerability requires user interaction (the victim triggering the task run) and privileges to authenticate, limiting the attack scope.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the task run functionality to trusted users only and consider implementing input validation or output encoding as a temporary mitigation. Monitor vendor communications for patches or official fixes.