CVE-2026-55839
Kestra: Stored XSS via custom Markdown [[link]] attribute injection
CVSS Score
8.7
EPSS Score
0.0%
EPSS Percentile
0th
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
| CWE | CWE-79 |
| Vendor | kestra-io |
| Product | kestra |
| Published | Aug 18, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for kestra-io kestra
Be the first to know when new high vulnerabilities affecting kestra-io kestra are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None
Affected Versions
kestra-io / kestra
< 1.3.24
References
github.com: https://github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8 github.com: https://github.com/kestra-io/kestra/pull/16835 github.com: https://github.com/kestra-io/kestra/commit/6c8e6d099ed172cbb6b003b7fb30b7bb1f8f710e github.com: https://github.com/kestra-io/kestra/releases/tag/v1.3.24