CVE-2025-53543

Kestra allows Stored XSS before 0.22 PUBLISHED

Description (CNA)

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

Affected (CNA)

Vendor / product	Versions
kestra-io / kestra	affected < 0.22.0

CWE

CWE-79

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.