CVE-2025-53543

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2025-53543

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53543.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-53543

Aliases

GHSA-qpj4-4r6r-wvf4

Published

2025-07-07T19:54:46.526Z

Modified

2026-04-10T05:32:20.716350Z

Severity

4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Kestra allows Stored XSS before 0.22

Details

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53543.json"
}

References

Affected packages

Git / github.com/kestra-io/kestra

Affected ranges

Type

GIT

Repo

https://github.com/kestra-io/kestra

Events

Introduced

Fixed

c5f2901f7f69595c0194ce089bc1cfe3a8b0e20e

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.22.0"
        }
    ]
}

Affected versions

v0.*

v0.19.0

v0.22.0-rc1-SNAPSHOT

v0.22.0-rc2-SNAPSHOT

v0.22.0-rc3-SNAPSHOT

v0.22.0-rc4-SNAPSHOT

v0.7.0

v0.7.1

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53543.json"