Kestra, an open-source orchestration platform, versions up to and including 1.3.3 improperly neutralize input during web page generation, specifically in user-supplied flow YAML metadata fields such as description and inputs[].displayName. These fields are rendered through the Markdown.vue component instantiated with html: true and injected into the DOM using Vue's v-html directive without sanitization. This results in a stored cross-site scripting vulnerability (CWE-79) that allows arbitrary JavaScript execution in the browsers of users who view or interact with the affected flows. This vulnerability is distinct from CVE-2026-29082 and requires minimal user interaction (zero-click for inputs[].displayName). The CVSS 3.1 base score is 7.3 (high severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and high impact on confidentiality and integrity.

Successful exploitation allows an attacker who can author flows to execute arbitrary JavaScript in the browsers of users viewing or interacting with those flows. This can lead to compromise of user session data, theft of sensitive information, or manipulation of the user interface. The vulnerability impacts confidentiality and integrity but does not affect availability. It requires the attacker to have privileges to create or modify flows but requires minimal user interaction to trigger.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict flow authoring privileges to trusted users only to reduce risk. Avoid viewing or interacting with untrusted flows. Monitor official Kestra project channels for updates regarding patches or mitigations.