Security Advisory

CVE-2026-55839

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-18 15:27:18

Last updated 2026-08-18 17:46:37

Assigner GitHub_M

CVSS score 8.7

State PUBLISHED

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.

← Browse all CVEs View on cve.org ↗