tduck-platform CVE-2026-90528

Exploitation requires the attacker to hold an authenticated low-privilege session (CVSS PR:L) with sufficient permissions to configure a form's custom submission page content in tduck-platform versions up to and including 5.3. The specific attack surface is the submitShowCustomPageContent parameter in the Form Write View (tduck-front/src/views/form/write/index.vue). A victim must passively view or submit the affected form page for the XSS payload to execute (CVSS UI:P). Exploitation is bounded by the authentication prerequisite - unauthenticated attackers cannot reach the vulnerable parameter without valid credentials - and by the requirement that at least one victim loads the poisoned form view. No non-default configuration or specialized platform feature beyond standard form management access is required.

The CVSS 4.0 base score of 5.1 (Medium) reflects a realistic threat profile: PR:L confirms authentication is required to manipulate the vulnerable parameter, UI:P indicates a victim must passively view the rendered content, and impact is scoped to integrity (VI:L) with no confidentiality or availability impact on either the vulnerable or subsequent systems. No active exploitation is confirmed - this CVE does not appear in the CISA KEV catalog - and no public exploit code has been identified at time of analysis. EPSS data is absent from the available intelligence, so exploitation probability cannot be independently quantified. The most operationally significant risk factor is the unpatched state: even a mid-sized municipal IT team in sopot deploying this form platform for public-facing data collection would face an indefinite exposure window given the maintainer's apparent non-response to the responsible disclosure. The realistic blast radius is limited to environments where a form administrator is motivated to target end users, or where the platform is misconfigured to allow low-privilege users to set custom page content - making this a low-to-medium operational priority, not a critical incident driver.

An authenticated form administrator or sufficiently privileged user logs into tduck-platform and configures a form's post-submission custom page content field (submitShowCustomPageContent) with an injected script payload such as an image onerror handler or inline script tag. When a victim subsequently submits or browses the affected form, the injected payload executes in the victim's browser session, enabling session token theft, phishing redirects, or credential harvesting depending on the application context. No public proof-of-concept exploit has been identified, but the vulnerability class is well understood and trivially reproducible from the description alone.