Is CVE-2026-55839 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-55839?

CVE-2026-55839 has a CVSS v3 severity of HIGH (8.7).

Back

CVE-2026-55839

Description

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.