EUVD-2026-68639

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task//run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from th...

CVE-2026-51153

Stored XSS in QD (versions 20220208 through 20250803) exists in TaskRunHandler.post() (web/handlers/task.py). When a task is run via /task//run, the handler renders log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. The logtmp value is populated fr...