Ad

CVE-2026-33664

HIGH CVSS 3.1: 5.4 EPSS 0.05%
Updated Mar 31, 2026
Kestra
Parameter Value
CVSS 5.4 (HIGH)
Affected Versions before 1.3.3
Type CWE-79 (Cross-Site Scripting (XSS))
Vendor Kestra
Public PoC No

Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with html: true. The resulting HTML is injected into the DOM via Vue's v-html without any sanitization. This allows a flow author to embed arbitrary JavaScript that executes in the browser of any user who views or interacts with the flow.

This is distinct from GHSA-r36c-83hm-pc8j / CVE-2026-29082, which covers only FilePreview.vue rendering .md files from execution outputs. The present finding affects different components, different data sources, and requires significantly less user interaction (zero-click for input.displayName). As of time of publication, it is unclear if a patch is available.

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
Required
User action required

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Vulnerable Products 1

Configuration From (including) Up to (excluding)
Kestra Kestra
cpe:2.3:a:kestra:kestra:*:*:*:*:*:*:*:*
<= 1.3.3

Related Vulnerabilities