CVE-2026-33664

Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with html: true. The resulting HTML is injected into the DOM via Vue's v-html without any sanitization. This allows a flow author to embed arbitrary JavaScript that executes in the browser of any user who views or interacts with the flow. This is distinct from GHSA-r36c-83hm-pc8j / CVE-2026-29082, which covers only FilePreview.vue rendering .md files from execution outputs. The present finding affects different components, different data sources, and requires significantly less user interaction (zero-click for input.displayName). As of time of publication, it is unclear if a patch is available.

• CWE-79

• https://github.com/kestra-io/kestra/security/advisories/GHSA-v2mc-8q95-g7hpExploit, Mitigation, Vendor Advisory
• https://github.com/kestra-io/kestra/security/advisories/GHSA-v2mc-8q95-g7hpExploit, Mitigation, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33659EspoCRM is an open source customer relationship management a…3.1
• CVE-2026-3366IBM InfoSphere Optim Test Data Fabrication 1.0.0, 1.0.0.1, 1…7.5
• CVE-2026-33660n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33661Pay is an open-source payment SDK extension package for vari…7.5
• CVE-2026-33662OP-TEE is a Trusted Execution Environment (TEE) designed as …7.5
• CVE-2026-33663n8n is an open source workflow automation platform. Prior to…6.5
• CVE-2026-33665n8n is an open source workflow automation platform. Prior to…7.5
• CVE-2026-33666Zserio is a framework for serializing structured data with a…7.5
• CVE-2026-33667OpenProject is an open-source project management application…7.4
• CVE-2026-33668Vikunja is an open-source self-hosted task management platfo…8.1
• CVE-2026-33669SiYuan is a personal knowledge management system. Prior to v…7.5
• CVE-2026-3367The Lockme OAuth2 calendars integration plugin for WordPress…4.4