CyberRota Analysis
AI-GeneratedThe vulnerability resides in the TaskRunHandler.post() function of the QD application, where it improperly renders task log content without HTML encoding, allowing for stored Cross-Site Scripting (XSS) attacks. An authenticated low-privileged attacker can exploit this flaw by crafting a HAR template that injects malicious scripts into the log variable, which then executes in the victim's browser when the task is run. Organizations using affected versions of the QD application should prioritize remediation to protect against potential exploitation and data compromise.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context.