Nixpkgs security tracker
NIXPKGS-2026-0542
GitHub issue
published on
Permalink
CVE-2026-29082
7.3 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): LOW
- User interaction (UI): REQUIRED
- Scope (S): UNCHANGED
- Confidentiality impact (C): HIGH
- Integrity impact (I): HIGH
- Availability impact (A): NONE
by @mweinelt Activity log
- Created automatic suggestion
- @mweinelt accepted
- @mweinelt published on GitHub
Kestra: Stored Cross-Site Scripting in Markdown File Preview
Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.
References
-
https://github.com/kestra-io/kestra/security/advisories/GHSA-r36c-83hm-pc8j x_refsource_CONFIRM
-
https://github.com/kestra-io/kestra/releases/tag/v1.0.30 x_refsource_MISC
Affected products
kestra
- ==<= 1.1.10
Matching in nixpkgs
pkgs.python312Packages.kestra
Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines
pkgs.python313Packages.kestra
Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines
pkgs.python314Packages.kestra
Infinitely scalable orchestration and scheduling platform, creating, running, scheduling, and monitoring millions of complex pipelines
Package maintainers
-
@DataHearth DataHearth <dev@antoine-langlois.net>