VulnerabilityDeferred

CVE-2025-53543

The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received.

MEDIUM 4.2EPSS 0.15%

Does this matter?

Lower severity and a low EPSS score (0.15%). Track it; it rarely justifies an emergency change on its own.

Description

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

CVSS 3.1: 4.2 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
EPSS: 0.15% probability · 5th percentile
CISA KEV: Not listed
Weakness: CWE-79
Source: security-advisories@github.com

References

https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.