{"id":"CVE-2026-55839","summary":"Kestra: Stored XSS via custom Markdown [[link]] attribute injection","details":"Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.","aliases":["GHSA-34pm-923j-7wf8"],"modified":"2026-08-20T10:17:17.733722Z","published":"2026-08-18T15:27:18.261Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55839.json"},"references":[{"type":"WEB","url":"https://github.com/kestra-io/kestra/releases/tag/v1.3.24"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55839.json"},{"type":"ADVISORY","url":"https://github.com/kestra-io/kestra/security/advisories/GHSA-34pm-923j-7wf8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55839"},{"type":"FIX","url":"https://github.com/kestra-io/kestra/commit/6c8e6d099ed172cbb6b003b7fb30b7bb1f8f710e"},{"type":"FIX","url":"https://github.com/kestra-io/kestra/pull/16835"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/kestra-io/kestra","events":[{"introduced":"0"},{"fixed":"6c8e6d099ed172cbb6b003b7fb30b7bb1f8f710e"},{"fixed":"51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"1.3.24"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.3.23","v1.3.22","v1.3.21","v1.3.20","v1.3.19","v1.3.18","v1.3.17","v1.3.16","v1.3.15","v1.3.14","v1.3.13","v1.3.11","v1.3.9","v1.3.8","v1.3.7","v1.3.6","v1.3.5","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.3.0-rc1","v1.3.0-rc0","v0.0.1234","v0.19.0","v0.9.1","v0.9.0","v0.8.1","v0.8.0","v0.7.1","v0.7.0"],"database_specific":{"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630","target":{"file":"executor/src/main/java/io/kestra/executor/ExecutorService.java"},"deprecated":false,"digest":{"line_hashes":["140357562688538205345254706729617935184","304622577954603750062645385810567482955","172583391333871376895219175659680168624","183202715105275968527562296723581938117","297530466543600923085808142532015000696","166130564697929043102664410002815835326"],"threshold":0.9},"id":"CVE-2026-55839-ae852aa8"},{"target":{"file":"webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java"},"deprecated":false,"digest":{"line_hashes":["114665094312657875926090929902087966387","274801199915747080465899563020440974966","162451514141723112063978488641837120054","311266650890310641974077291142530475109","36923110329716295121989747954185703358","25482173696437418952014903161456696174"],"threshold":0.9},"id":"CVE-2026-55839-b849bba4","signature_type":"Line","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630"},{"id":"CVE-2026-55839-c95e9421","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630","target":{"file":"webserver/src/test/java/io/kestra/webserver/controllers/api/ExecutionControllerRunnerTest.java","function":"shouldRunFlowableAfterExecutionWhenExecutionIsKilled"},"deprecated":false,"digest":{"function_hash":"290069323323167062483700325176558449078","length":1430}},{"id":"CVE-2026-55839-d6418229","signature_type":"Function","signature_version":"v1","source":"https://github.com/kestra-io/kestra/commit/51fcc9e4e7b69a706e10f77aaf1fdf56b7eb6630","target":{"file":"executor/src/main/java/io/kestra/executor/ExecutorService.java","function":"process"},"deprecated":false,"digest":{"function_hash":"164146531972406519589227532778007779872","length":1414}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-55839.json","vanir_signatures_modified":"2026-08-20T10:17:17Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}