CVE-2026-55839

## Summary Kestra’s Markdown renderer supports a custom `[[link ...]]` syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can create or edit Markdown-rendered content, such as a Flow description, can inject JavaScript event-handler attributes. When another user views or interacts with the affected Markdown-rendered UI element, the JavaScript executes in that user’s browser. This is not a normal raw-HTML Markdown payload such as `<img onerror=...>`. The payload uses Kestra’s custom `[[link]]` Markdown syntax, and the dangerous HTML attributes are introduced by Kestra’s own Markdown plugin. ## Affected version Tested on Kestra `1.3.22`. ## Affected components Source review identified the issue in the custom Markdown link renderer: * `ui/src/utils/markdown_plugins/link.ts` * `ui/src/utils/markdown.ts` * `ui/src/components/layout/Markdown.vue` The vulnerable code path renders parsed attributes directly into an HTML string: ```ts const attrs = token.attrs ? token.attrs.map(([name, value]) => `${name}="${value}"`).join("") : ""; return `<router-md ${attrs}>`; ``` The implementation does not safely restrict attribute names or values before inserting the generated HTML into the DOM. ## Proof of concept Create or edit a Flow with the following YAML: ```yaml id: markdown_xss_flow_desc namespace: company.team description: | [[link x="y" style="position:fixed;inset:0;z-index:9999;background:rgba(255,0,0,0.05)" onmouseover="alert(document.domain)"]] tasks: - id: hello type: io.kestra.plugin.core.log.Log message: hello ``` Save the Flow. Then navigate to the Flow list: ```text http://localhost:8080/ui/main/flows ``` Click the description/info icon next to the malicious Flow. ## Actual result The browser executes JavaScript from the Flow description. In the PoC, an ale