The vulnerability CVE-2026-90528 affects TDuckApp tduck-platform versions 5.0, 5.1, 5.2, and 5.3. It is a cross-site scripting issue in the Form Write View component, caused by improper handling of the submitShowCustomPageContent argument in the file tduck-front/src/views/form/write/index.vue. This allows an attacker to inject malicious scripts remotely. The vulnerability has a CVSS 4.0 base score of 5.1, indicating medium severity, with no privileges required but user interaction needed. The project was notified early but has not yet responded or issued a fix.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other malicious actions within the user's browser session. The attack is remote and requires user interaction but no elevated privileges. There are no known exploits in the wild at this time.

No official fix or patch has been released by the vendor as of the current information. Users and administrators should monitor the vendor's channels for updates and advisories. Until a patch is available, consider applying input validation or sanitization controls on the submitShowCustomPageContent parameter if possible, or restrict access to the affected functionality to trusted users only.