CVE-2026-29082

Description

Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.

PUBLISHED Reserved 2026-03-03 | Published 2026-03-06 | Updated 2026-03-06 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

References

github.com/...kestra/security/advisories/GHSA-r36c-83hm-pc8j

github.com/kestra-io/kestra/releases/tag/v1.0.30

cve.org (CVE-2026-29082)

nvd.nist.gov (CVE-2026-29082)

Download JSON