CyberRota Analysis
AI-GeneratedKestra's custom Markdown parser prior to version 1.3.24 is vulnerable to stored cross-site scripting (XSS) due to improper handling of user-generated content, allowing attackers to inject JavaScript event-handler attributes through the [[link]] syntax. This vulnerability can lead to unauthorized script execution when other users view the affected Flow descriptions, potentially compromising user data and session integrity. Organizations using Kestra should prioritize upgrading to version 1.3.24 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.