Description

A flaw has been found in TDuckApp tduck-platform up to 5.3. Affected by this vulnerability is an unknown functionality of the file tduck-front/src/views/form/write/index.vue of the component Form Write View. This manipulation of the argument submitShowCustomPageContent causes cross site scripting. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-09-13T15:16:28.650Z",
  "pubdate": "2026-09-13T15:16:28.650Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the tduck-platform up to version 5.3. The flaw is located in the Form Write View component, specifically within the tduck-front/src/views/form/write/index.vue file.\nThis vulnerability occurs due to improper neutralization of user-supplied input provided via the 'submitShowCustomPageContent' argument before rendering it in the browser.\nThe vulnerability allows remote, unauthenticated attackers to execute arbitrary JavaScript in the context of the victim's session. Successful exploitation may lead to session hijacking, unauthorized actions performed on behalf of the user, theft of sensitive data, or redirection to malicious websites.\nGiven that the project maintainers have not yet provided a resolution, the platform remains exposed. Organizations utilizing TDuckApp are at risk of client-side attacks that bypass standard server-side security controls.",
  "technicalDetails": "The vulnerability is a classic Reflected Cross-Site Scripting (XSS) flaw, stemming from the application's failure to adequately sanitize or encode input reflected in the document object model (DOM).\nThe vulnerable component is the Form Write View, which processes form submissions. The specifically identified vector is the 'submitShowCustomPageContent' argument handled within 'tduck-front/src/views/form/write/index.vue'. When this argument is processed, the application fails to perform sufficient output encoding, allowing the injection of malicious script tags or attribute-based execution payloads.\nThe attack flow proceeds as follows: 1. An attacker identifies a target URL associated with the Form Write View and constructs a malicious link containing a JavaScript payload within the 'submitShowCustomPageContent' parameter. 2. The attacker tricks an authenticated user into clicking this crafted link. 3. Upon loading, the vulnerable frontend component processes the 'submitShowCustomPageContent' input and renders it directly into the HTML document. 4. The browser executes the injected JavaScript code with the privileges of the victim's session.\nThe payload behavior is limited only by the attacker's intent; since the script executes within the origin of the tduck-platform, it can access document cookies (unless flagged as HttpOnly), retrieve local storage data, perform API calls to the application backend, or modify the visual representation of the page to conduct phishing or UI redressing.\nThe vulnerability is remotely exploitable without requiring prior authentication, significantly increasing the attack surface. As the issue is rooted in client-side code execution, it is particularly effective against users currently logged into the platform, facilitating persistent compromise of the user account. Because the application logic fails to properly validate the structure and content of the 'submitShowCustomPageContent' parameter, the browser treats the input as executable code rather than plain text. This flaw highlights a lack of secure coding practices regarding DOM manipulation and content rendering in the frontend framework."
}