CVE-2026-51153: XSS
Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from newenv.variables.log, which is attacker-controlled via the template extractvariables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the log variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
QD instances in the affected 20220208 through 20250803 range are exposed when low-privileged authenticated users can create or modify HAR templates and another user runs the crafted task. The script executes in the browser of the user who triggers that task.
What does an attacker need to exploit it?
The attacker needs a low-privileged authenticated QD account and the ability to create a crafted HAR template. The template can use the api://util/unicode endpoint and the extract_variables mechanism to place attacker-controlled HTML or JavaScript into the __log__ variable.
Is exploitation triggered merely by creating the malicious task?
No. The payload is rendered when the task is run through /task/<taskid>/run, so a victim must trigger execution of the crafted task for the script to run in that victim's browser.
How can I identify potentially affected tasks?
Review HAR templates created or modified by low-privileged users for extract_variables usage that writes to __log__, especially templates referencing api://util/unicode. Also review task runs initiated through /task/<taskid>/run for suspicious log content.