CVE-2026-51153
Received Received - Intake

Stored XSS in QD TaskRunHandler via Log Injection

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: MITRE

Description
Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-08-31
AI Q&A
2026-08-31
EPSS Evaluated
N/A
NVD
CVE-2026-51153
EUVD
EUVD-2026-68639

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
qd qd From 20220208 (inc) to 20250803 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the QD application. It exists in the TaskRunHandler.post() function in web/handlers/task.py. When a task runs, the handler renders task log content into HTML responses without proper HTML encoding. An attacker can inject malicious scripts via a crafted HAR template that controls the __log__ variable. When a victim runs the task, the script executes in their browser within the QD application context.

Detection Guidance

Check QD application logs for suspicious task runs or templates containing script tags or unusual payloads. Inspect web/handlers/task.py for TaskRunHandler.post() function usage of logtmp without HTML encoding. Monitor network traffic for requests to api://util/unicode with encoded payloads.

Impact Analysis

An attacker could steal session cookies, perform actions on your behalf, or redirect you to malicious sites. Since the script runs in the QD application context, it may access sensitive data or manipulate task configurations. Low-privileged users could escalate privileges or compromise other users' sessions.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection. Stored XSS may enable attackers to exfiltrate sensitive information, resulting in non-compliance with data confidentiality and integrity standards.

Mitigation Strategies

Upgrade QD to a version beyond 20250803. Apply input validation and output encoding to sanitize logtmp content. Restrict access to api://util/unicode endpoint. Review and remove any untrusted templates or tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-51153. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart