High severity8.7NVD Advisory· Published Aug 18, 2026· Updated Sep 16, 2026
CVE-2026-55839
CVE-2026-55839
Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
io.kestra:kestraMaven | < 1.3.24 | 1.3.24 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-34pm-923j-7wf8ghsaADVISORY
- github.com/kestra-io/kestra/commit/6c8e6d099ed172cbb6b003b7fb30b7bb1f8f710envdWEB
- github.com/kestra-io/kestra/releases/tag/v1.3.24nvdWEB
- github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8nvdWEB
- github.com/kestra-io/kestra/pull/16835nvd
News mentions
0No linked articles in our index yet.