Kyverno versions prior to 2.5.2 allow stored cross‑site scripting through the PropertyCard component. The component uses Vue's v-html to render arbitrary strings from a policy report's properties field without escaping. An attacker with permission to write PolicyReport objects can inject a payload that executes when the issuer's UI loads, potentially hijacking accounts, leaking data, and executing arbitrary scripts. This is a classic stored XSS vulnerability, classified as CWE-79.

Kyverno policy engine before 2.5.2, including the policy‑reporter‑ui component, is affected. All installations of Kyverno that have not applied the 2.5.2 (or newer) release are vulnerable.

The CVSS score of 6.1 indicates moderate severity. With no publicly available exploit and no listing in the CISA KEV catalog, the likelihood of exploitation depends on a cluster principal possessing write access to PolicyReport objects. An attacker could craft a malicious policy report that injects script fragments; when the UI is rendered, the script runs in the context of the viewer's browser, enabling credential theft or session hijacking.