Kestra's custom Markdown parser, found in the UI utilities, accepts a non‑standard [[link]] syntax that allows privileged users to embed JavaScript event‑handler attributes. When such an attribute is injected into a Flow description, the text is stored and later rendered in the Flow list or information panel, enabling a stored XSS attack against subsequent viewers. The weakness is a classic injection of client‑side code (CWE‑79).

Versions of Kestra produced by kestra‑io prior to 1.3.24 are impacted. The vulnerability exists in the open‑source event‑driven orchestration platform and has been removed in release 1.3.24.

The calculated CVSS score of 8.7 classifies the flaw as high severity. EPSS data is unavailable, so the precise exploitation probability is undetermined, but the flaw is not listed in the CISA KEV catalog. An attacker must possess permissions to create or modify a Flow description to inject the payload, after which any user who views that description could be affected. The impact allows unauthorized manipulation of the victim’s browser session through arbitrary script execution.