CVE-2026-55839
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Kestra before version 1.3.24 has a stored XSS vulnerability in its custom Markdown parser. A user with permission to create or update a Flow description can inject JavaScript event-handler attributes via the [[link]] syntax, causing script execution when another user opens the description or information panel.
Risk Assessment
An attacker can execute malicious scripts in other users' browsers, potentially leading to session theft, account takeover, or other attacks within the application context.
Recommendation
Upgrade Kestra to version 1.3.24 or later, which includes the fix.
Original NVD description (English source)
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.