CVE-2025-53543

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

Score

CVSS 3.1 4.2 Medium

Status

Deferred - security-advisories@github.com

Published

2025-07-07

Last modified

2025-07-07

Weaknesses

CWE-79

Affected products

• Kestra (Kestra-io)

References

• https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4