AIKIDO-2026-18183

TL;DR

The resque-web admin interface renders queue names, worker identifiers, job class names, job payload fields, failed-job details, and Redis keys and values into HTML text nodes and href attributes without escaping them. Anyone able to enqueue a job or register a worker controls these values, so a crafted queue name or payload such as "><svg onload=alert(1)> injects markup that runs when an operator opens the affected page. This stores attacker-controlled script in the dashboard and executes it in the operator's session. The fix escapes these values with h/escape_html before rendering and serves /stats.txt as text/plain.