Executive brief
Kestra's custom Markdown parser for Flow descriptions fails to validate HTML attributes before rendering them into the page. An attacker with permission to create or edit a Flow can inject malicious JavaScript event handlers (like onclick or onmouseover) that execute when other users view the Flow description. This allows privilege escalation in multi-user deployments where less-privileged authors can compromise more-privileged users.
Technical details
The vulnerability exists in Kestra's custom Markdown link plugin (ui/src/utils/markdown_plugins/link.ts) which converts [[link ...]] syntax into HTML elements. The vulnerable code directly concatenates attacker-controlled attributes into an HTML string without sanitization: `const attrs = token.attrs ? token.attrs.map(([name, value]) => `${name}="${value}"`).join("") : ""; return \`<router-md ${attrs}>\`;`. This allows injection of event-handler attributes (onclick, onmouseover, etc.) and dangerous styling attributes. An attacker with Flow creation/edit permissions can store the malicious payload in a Flow description. When a victim user views the Flow list and opens the description panel, the JavaScript executes in the victim's browser context with the victim's privileges. The attack requires the victim to interact with the Flow description UI, but does not require Flow execution. Patch is available in version 1.3.24.
Affected products
- Kestra Kestra < 1.3.24
Timeline
- 2026-08-18: disclosed: Published to GitHub Advisory Database
- 2026-08-11: patched: Fixed in version 1.3.24