CVE-2026-90528: TDuckApp tduck-platform Form Write View index.vue cross site scripting
A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Event History
Frequently Asked Questions
Which versions should be considered affected?
TDuckApp tduck-platform versions up to and including 5.3 are identified as affected.
Does exploitation require attacker access or user interaction?
The supplied vector indicates low privileges are required and user interaction is required. The attack can be carried out remotely.
Has the project acknowledged or responded to the report?
The project was informed early through an issue report, but no response had been received at the time of publication.