CVE-2025-53543

Vulnerability

Kestra versions prior to 0.22.0 contain a stored cross-site scripting (XSS) vulnerability in the execution "Overview" tab. The bug stems from improper handling of HTTP responses; when a task receives an error response (e.g., HTTP 504), the raw response body is rendered without sanitization, allowing embedded JavaScript to execute in the context of the Kestra application [1].

Exploitation

An attacker can exploit this by hosting a web server that returns a crafted error page containing a JavaScript payload, such as an onerror handler in an `` tag. A Kestra workflow that makes an HTTP request to the attacker-controlled endpoint will receive the malicious response. Once the execution finishes with an error, navigating to the execution's "Overview" tab renders the response, triggering the XSS [1].

Impact

Successful execution of arbitrary JavaScript in the victim's browser can lead to compromise of the Kestra instance. The attacker could steal session tokens, perform actions on behalf of the authenticated user, or access sensitive data visible within the application [1].

Mitigation

The vulnerability is fixed in Kestra version 0.22.0. Users are advised to upgrade immediately. No workarounds are documented [1].