CVE-2026-55839 Kestra: Stored XSS via custom Markdown [[link]] attribute injection
An attacker with flow creation permissions can inject JavaScript via custom Markdown links, leading to stored XSS against other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-55839?
CVE-2026-55839 is a high-severity cross-site scripting vulnerability in kestra-io kestra, published on 18 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.
Weakness: CWE-79
Which versions are affected by CVE-2026-55839?
2 open source packages ship an affected version, including io.kestra:kestra.
| Package | Affected | Fixed in |
|---|---|---|
io.kestra:kestra Maven | All versions | 1.3.24 |
io.kestra:kestra Maven | All versions | 1.3.24 |
How do I fix CVE-2026-55839?
Upgrade io.kestra:kestra to 1.3.24 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-55839 being exploited?
There is no known exploitation of CVE-2026-55839 in the wild and no public exploit code.
Sources
Also known as GHSA-34pm-923j-7wf8.