Executive brief
TDuck is an open-source form and survey platform that allows users to create and manage forms with custom branding. A flaw allows authenticated form creators to inject malicious scripts into custom submission success messages, which are then executed in the browsers of anonymous users who submit the form. An attacker with form ownership can craft a payload that executes JavaScript in the context of the form page, potentially stealing form data or performing unauthorized actions on behalf of victims.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the form submission success page. An authenticated form owner can save a malicious payload via the POST /user/form/setting/save endpoint in the submitShowCustomPageContent parameter. When an anonymous user successfully submits the form, the frontend renders this field unsafely using Vue's v-html directive (in tduck-front/src/views/form/write/index.vue) without sanitization, allowing arbitrary JavaScript execution. The attack requires the attacker to be a form owner or creator, but the victims need no account. The injected script runs in the same origin context as the public form page. No patch has yet been confirmed as available.
Affected products
- TDuckApp tduck-platform up to 5.3
Timeline
- 2026-08-01: disclosed
- 2026-09-13: advisory