CVE-2026-44245

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.

• CWE-79

• https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388Exploit, Vendor Advisory
• https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388Exploit, Vendor Advisory

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4424A flaw was found in libarchive. This heap out-of-bounds read…7.5
• CVE-2026-44240basic-ftp is an FTP client for Node.js. Prior to 5.3.1, basi…7.5
• CVE-2026-44241Micronaut Framework is a JVM-based full stack Java framework…7.5
• CVE-2026-44242Micronaut Framework is a JVM-based full stack Java framework…3.7
• CVE-2026-44243GitPython is a python library used to interact with Git repo…7.1
• CVE-2026-44244GitPython is a python library used to interact with Git repo…7.8
• CVE-2026-44246nnU-Net is a semantic segmentation framework that automatica…7.2
• CVE-2026-44247Volcano is a Kubernetes-native batch scheduling system. Prio…7.4
• CVE-2026-44248Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-44249Netty is a network application framework for development of …8.1
• CVE-2026-4425Rejected reason: Reserved for EastLink case, but no need for…
• CVE-2026-44250Netty is a network application framework for development of …7.5