CVE-2026-55839: Kestra stored XSS via custom Markdown link attribute injection

CVE-2026-55839 · Severity: high · CVSS 8.7 · Published 2026-08-18

Kestra's custom Markdown parser for Flow descriptions fails to validate HTML attributes before rendering them into the page. An attacker with permission to create or edit a Flow can inject malicious JavaScript event handlers (like onclick or onmouseover) that execute when other users view the Flow description. This allows privilege escalation in multi-user deployments where less-privileged authors can compromise more-privileged users.

Technologies: Kestra. Vendors: Kestra, Maven.

Quick answers

Is CVE-2026-55839 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55839 being exploited in the wild.
How severe is CVE-2026-55839?
High severity, with a CVSS score of 8.7, published 18 August 2026.
Which products and versions are affected?
Kestra < 1.3.24; io.kestra:kestra (Maven) < 1.3.24, ECOSYSTEM:introduced=0,fixed=1.3.24.
Is there a fix for CVE-2026-55839?
Yes. io.kestra:kestra (Maven): upgrade to 1.3.24 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55839 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-55839?
Check whether you run Kestra or io.kestra:kestra (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • io.kestra:kestra (Maven): upgrade to 1.3.24 or later
    # set io.kestra:kestra to 1.3.24 in your pom.xml or build.gradle

Technical details

The vulnerability exists in Kestra's custom Markdown link plugin (ui/src/utils/markdown_plugins/link.ts) which converts [[link ...]] syntax into HTML elements. The vulnerable code directly concatenates attacker-controlled attributes into an HTML string without sanitization: `const attrs = token.attrs ? token.attrs.map(([name, value]) => `${name}="${value}"`).join("") : ""; return \`<router-md ${attrs}>\`;`. This allows injection of event-handler attributes (onclick, onmouseover, etc.) and dangerous styling attributes. An attacker with Flow creation/edit permissions can store the malicious payload in a Flow description. When a victim user views the Flow list and opens the description panel, the JavaScript executes in the victim's browser context with the victim's privileges. The attack requires the victim to interact with the Flow description UI, but does not require Flow execution. Patch is available in version 1.3.24.

Affected products

  • Kestra Kestra < 1.3.24

Identifiers

  • CVE-2026-55839
  • GHSA-34pm-923j-7wf8

Timeline

  • 2026-08-18: disclosed: Published to GitHub Advisory Database
  • 2026-08-11: patched: Fixed in version 1.3.24

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.