CVE-2026-51153: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TaskRunHandler.post in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/ /run, the handler renders task log content logtmp into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from t...