CVE-2025-53543: Kestra allows Stored XSS before 0.22
Published Jul 7, 2025
·Updated
Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.
Affected Software
1 affected component
Kestra Kestra<0.22
Event History
Jul 7, 2025
CVE Published
via MITRE·07:54 PM
Data Sourced
via MITRE·07:54 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-53543?
CVE-2025-53543 is classified as a high severity vulnerability due to its potential for stored cross-site scripting (XSS) attacks.
2
How do I fix CVE-2025-53543?
To fix CVE-2025-53543, update Kestra to version 0.22.0 or later.
3
What are the implications of CVE-2025-53543?
The implications of CVE-2025-53543 include the possibility of an attacker executing arbitrary JavaScript in the context of a victim's session.
4
Which versions of Kestra are affected by CVE-2025-53543?
Kestra versions prior to 0.22.0 are affected by CVE-2025-53543.
5
Is there a public advisory for CVE-2025-53543?
Yes, there is a public advisory available regarding CVE-2025-53543 detailing the vulnerability and its fix.