User Input Vulnerability in Kestra Event-Driven Orchestration Platform

CVE-2026-33664

What is CVE-2026-33664?

The Kestra platform, an open-source event-driven orchestration tool, is susceptible to a vulnerability that enables flow authors to inject arbitrary JavaScript into the platform. This vulnerability arises from the handling of user-supplied YAML metadata fields, which include description and input display names. When rendered through the Markdown.vue component with HTML enabled, this unfiltered content is directly inserted into the DOM. Consequently, malicious scripts can be executed in the browsers of users who view or interact with the affected flows, raising serious security concerns for Kestra users. Users are encouraged to review the official advisory for further information.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References