CVE-2026-33664: Kestra Vulnerable to Stored Cross-Site Scripting via Flow YAML Fields
Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with html: true. The resulting HTML is injected into the DOM via Vue's v-html without any sanitization. This allows a flow author to embed arbitrary JavaScript that executes in the browser of any user who views or interacts with the flow. This is distinct from GHSA-r36c-83hm-pc8j / CVE-2026-29082, which covers only FilePreview.vue rendering .md files from execution outputs. The present finding affects different components, different data sources, and requires significantly less user interaction (zero-click for input.displayName). As of time of publication, it is unclear if a patch is available.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33664?
CVE-2026-33664 has a medium severity rating due to its potential for stored cross-site scripting (XSS) attacks.
How do I fix CVE-2026-33664?
To fix CVE-2026-33664, upgrade Kestra to version 1.3.4 or later, where the vulnerability is addressed.
What components are affected by CVE-2026-33664?
CVE-2026-33664 affects flow YAML metadata fields such as description, inputs[].displayName, and inputs[].description in Kestra versions up to and including 1.3.3.
What attack vectors are associated with CVE-2026-33664?
Attack vectors for CVE-2026-33664 include the injection of malicious scripts through user-supplied flow YAML fields.
Who is affected by CVE-2026-33664?
Any users of Kestra versions up to and including 1.3.3 are potentially affected by CVE-2026-33664 if they allow external input in the affected fields.