Executive brief
Kyverno Policy Reporter UI is a dashboard used by platform engineering teams to view security and compliance reports for Kubernetes clusters. A vulnerability in the user interface allows malicious scripts to be embedded within policy reports; when an administrator views these reports, the script executes in their browser. This could allow an attacker to steal session cookies, perform actions on behalf of the user, or gain unauthorized access to the management console.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in the PropertyCard.vue component of Kyverno's policy-reporter-ui. The application uses Vue 3's v-html directive to render property values from Kubernetes PolicyReport objects without proper sanitization. While an isURL() guard is present, it only checks for http/https schemes; any non-URL string (such as an HTML payload) longer than 75 characters bypasses this check and is injected directly into the DOM. An attacker with write access to PolicyReport resources in a cluster can craft a malicious property value that executes arbitrary JavaScript in the context of a UI user's session. This issue is resolved in version 2.5.2.
Affected products
- Kyverno policy-reporter-ui < 2.5.2
Timeline
- 2026-04-29: advisory: GitHub advisory published by maintainers
- 2026-05-12: disclosed: CVE published to NVD
- 2026-05-12: patched: Fixed in version 2.5.2