Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.7",
  "pubDate": "2026-08-18T16:17:53.710Z",
  "pubdate": "2026-08-18T16:17:53.710Z",
  "executiveSummary": "A stored cross-site scripting vulnerability exists within Kestra prior to version 1.3.24. The flaw allows authenticated users with permissions to create or update a Flow description to inject malicious JavaScript event-handler attributes via the custom markdown parser. When another user subsequently views the affected Flow description or accesses the information panel within the Flow list, the injected payload executes within the context of the victim's browser session. This vulnerability poses significant risk to application integrity and user session security, enabling potential unauthorized actions and data exposure through client-side script execution. Successful exploitation requires specific authorization to modify Flow descriptions but no specialized client-side interaction beyond viewing the compromised interface component.",
  "technicalDetails": "The vulnerability resides in the custom Markdown parser implemented in ui/src/utils/markdown_plugins/link.ts within the Kestra platform. The root cause stems from insufficient input sanitization and improper output encoding of user-supplied data processed through the custom [[link]] syntax. Specifically, the parser fails to adequately filter dangerous HTML attributes, such as JavaScript event-handlers, allowing arbitrary code injection directly into the rendered Document Object Model.\nAttack flow begins when an adversarial user leverages existing permissions to create or update a Flow, embedding a crafted payload containing malicious event-handler attributes within the Flow description using the [[link]] syntax. This payload is persistently stored in the backend database. Subsequently, when an unsuspecting victim navigates to the Flow list or opens the detailed information panel containing the malicious description, the custom Markdown parser renders the input without proper sanitization. The browser interprets the injected event-handler attributes, triggering execution of arbitrary JavaScript code in the context of the victim's active session.\nThe vulnerable component is the Markdown link processing module located at ui/src/utils/markdown_plugins/link.ts. Affected software versions include all deployments of Kestra prior to version 1.3.24. Exploitation requires authenticated access with sufficient privileges to create or update Flow configurations. The attack vector is stored (persistent) cross-site scripting, operating via the web application interface and impacting any user who views the corrupted resource."
}