Kestra is vulnerable to a cross-site scripting attack, which could allow an authenticated user to execute malicious scripts in the context of another user's session.

This is a cross-site scripting (CWE-79) vulnerability occurring in the execution-file preview functionality. The application renders user-supplied Markdown with HTML enabled and injects it using Vue’s v-html directive without proper sanitization, requiring the attacker to have low-level authenticated access.

Successful exploitation of this vulnerability could allow an attacker to hijack user sessions, steal sensitive session tokens, or perform unauthorized actions on behalf of other authenticated users. Given the CVSS score of 7.3, this flaw poses a significant risk to the integrity and confidentiality of the orchestration platform environment, particularly if administrative accounts are targeted.

Immediate Action: As there is no official patch available at this time, administrators should restrict access to the execution-file preview feature if possible and monitor for suspicious input patterns.

Proactive Monitoring: Review web access logs for anomalous requests containing Markdown syntax or HTML tags directed at the file preview endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to inspect and block cross-site scripting payloads in incoming requests.

Public Exploit Available: Unknown.

The risk posed by this cross-site scripting vulnerability is elevated due to the existence of a proof-of-concept. Organizations should prioritize implementing WAF-based mitigations and monitoring user activity closely until the vendor releases a secure version of the platform.