CVE-2025-53543

MEDIUM

Kestra < 0.22.0 - Stored Cross-Site Scripting in Execution Overview Tab

Title source: llm
STIX 2.1

Description

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

References (1)

Core 1
Core References

Scores

CVSS v3 4.2
EPSS 0.0015
EPSS Percentile 4.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
kestra-io/kestra < 0.22.0
Published Jul 07, 2025
Tracked Since Feb 18, 2026