CVE-2026-55839: Kestra: Stored XSS via custom Markdown [[link]] attribute injection
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kestrato a version that resolves this vulnerability.Fixed in 1.3.24
Event History
Frequently Asked Questions
Who can exploit this issue, and who is exposed to the stored payload?
Users who can create or update Flow descriptions can introduce the malicious content. The payload executes when another user opens the affected Flow description or its information panel in the Flow list.
What access and interaction are required for exploitation?
Exploitation requires low-level privileges to create or modify a Flow description and user interaction from a victim who opens the description or information panel. The vulnerable input is the custom [[link]] Markdown syntax, which can be used to inject JavaScript event-handler attributes.
What version contains the fix?
Upgrade Kestra to version 1.3.24, which fixes the issue.