CVE-2026-55839 in Kestra
要約
〜によって MITRE • 2026年08月18日
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.