Skip to main content

Kestra Io

Vendor security scorecard – 1 CVEs in the selected period

Period: 30d 90d 6m 1y All
Risk 12
1
CVEs
0
Critical
1
High
0
KEV
1
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.3%
Avg EPSS

Severity Breakdown

CRITICAL
0
HIGH
1
MEDIUM
0
LOW
0

Monthly CVE Trend

Top Risky CVEs

CVE Summary Severity CVSS EPSS Priority Signals
CVE-2026-55839 Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis. HIGH 8.7 0.3% 44
PoC

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy