CVE-2026-44245

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44245
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44245.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44245
Aliases
Downstream
Related
Published
2026-05-12T22:46:59.776Z
Modified
2026-08-12T03:51:09.833989556Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component
Details

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44245.json"
}
References

Affected packages

Git / github.com/kyverno/kyverno

Affected ranges

Type
GIT
Repo
https://github.com/kyverno/kyverno
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
420ac57541a3767f052d57044f636b17d9e0c346
Database specific
Show details 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.2"
        }
    ]
}
Type
GIT
Repo
https://github.com/kyverno/policy-reporter-ui
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ee15078f75f86f4ac9b1cf38bea4742e6453d1c6
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:kyverno:policy-reporter-ui:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.5.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

1.*
1.3.0-rc10
1.6-dev
1.7-dev
1.8-dev
2.*
2.0.0-rc.5
helm-chart-v2.*
helm-chart-v2.0.3
helm-chart-v2.0.3-rc1
helm-chart-v2.0.3-rc2
helm-chart-v2.1.0
helm-chart-v2.1.3
kyverno-chart-v2.*
kyverno-chart-v2.4.0
kyverno-chart-v2.4.0-rc1
kyverno-chart-v2.4.0-rc2
kyverno-chart-v2.4.0-rc3
kyverno-chart-v2.4.1
kyverno-chart-v2.4.2
kyverno-chart-v2.5.0
kyverno-chart-v2.5.1
kyverno-chart-v2.5.2-rc1
kyverno-chart-v2.5.2-rc2
kyverno-policies-chart-v2.*
kyverno-policies-chart-v2.4.0
kyverno-policies-chart-v2.4.0-rc1
kyverno-policies-chart-v2.4.0-rc2
kyverno-policies-chart-v2.4.0-rc3
kyverno-policies-chart-v2.4.1
kyverno-policies-chart-v2.4.2
kyverno-policies-chart-v2.5.0
kyverno-policies-chart-v2.5.1
kyverno-policies-chart-v2.5.2-rc1
kyverno-policies-chart-v2.5.2-rc2
policy-reporter-ui-chart-v0.*
policy-reporter-ui-chart-v0.0.1
policy-reporter-ui-chart-v0.0.10
policy-reporter-ui-chart-v0.0.11
policy-reporter-ui-chart-v0.0.12
policy-reporter-ui-chart-v0.0.13
policy-reporter-ui-chart-v0.0.14
policy-reporter-ui-chart-v0.0.15
policy-reporter-ui-chart-v0.0.16
policy-reporter-ui-chart-v0.0.17
policy-reporter-ui-chart-v0.0.18
policy-reporter-ui-chart-v0.0.19
policy-reporter-ui-chart-v0.0.2
policy-reporter-ui-chart-v0.0.20
policy-reporter-ui-chart-v0.0.21
policy-reporter-ui-chart-v0.0.22
policy-reporter-ui-chart-v0.0.23
policy-reporter-ui-chart-v0.0.24
policy-reporter-ui-chart-v0.0.3
policy-reporter-ui-chart-v0.0.4
policy-reporter-ui-chart-v0.0.5
policy-reporter-ui-chart-v0.0.6
policy-reporter-ui-chart-v0.0.7
policy-reporter-ui-chart-v0.0.8
policy-reporter-ui-chart-v0.0.9
policy-reporter-ui-v2.*
policy-reporter-ui-v2.0.0-alpha.1
policy-reporter-ui-v2.0.0-alpha.10
policy-reporter-ui-v2.0.0-alpha.11
policy-reporter-ui-v2.0.0-alpha.12
policy-reporter-ui-v2.0.0-alpha.13
policy-reporter-ui-v2.0.0-alpha.14
policy-reporter-ui-v2.0.0-alpha.15
policy-reporter-ui-v2.0.0-alpha.16
policy-reporter-ui-v2.0.0-alpha.17
policy-reporter-ui-v2.0.0-alpha.18
policy-reporter-ui-v2.0.0-alpha.19
policy-reporter-ui-v2.0.0-alpha.2
policy-reporter-ui-v2.0.0-alpha.20
policy-reporter-ui-v2.0.0-alpha.21
policy-reporter-ui-v2.0.0-alpha.22
policy-reporter-ui-v2.0.0-alpha.23
policy-reporter-ui-v2.0.0-alpha.24
policy-reporter-ui-v2.0.0-alpha.25
policy-reporter-ui-v2.0.0-alpha.26
policy-reporter-ui-v2.0.0-alpha.27
policy-reporter-ui-v2.0.0-alpha.28
policy-reporter-ui-v2.0.0-alpha.29
policy-reporter-ui-v2.0.0-alpha.3
policy-reporter-ui-v2.0.0-alpha.30
policy-reporter-ui-v2.0.0-alpha.31
policy-reporter-ui-v2.0.0-alpha.32
policy-reporter-ui-v2.0.0-alpha.33
policy-reporter-ui-v2.0.0-alpha.34
policy-reporter-ui-v2.0.0-alpha.37
policy-reporter-ui-v2.0.0-alpha.39
policy-reporter-ui-v2.0.0-alpha.4
policy-reporter-ui-v2.0.0-alpha.40
policy-reporter-ui-v2.0.0-alpha.44
policy-reporter-ui-v2.0.0-alpha.48
policy-reporter-ui-v2.0.0-alpha.49
policy-reporter-ui-v2.0.0-alpha.5
policy-reporter-ui-v2.0.0-alpha.6
policy-reporter-ui-v2.0.0-alpha.7
policy-reporter-ui-v2.0.0-alpha.8
policy-reporter-ui-v2.0.0-alpha.9
policy-reporter-ui-v2.0.0-beta.1
policy-reporter-ui-v2.0.0-beta.10
policy-reporter-ui-v2.0.0-beta.11
policy-reporter-ui-v2.0.0-beta.12
policy-reporter-ui-v2.0.0-beta.13
policy-reporter-ui-v2.0.0-beta.14
policy-reporter-ui-v2.0.0-beta.15
policy-reporter-ui-v2.0.0-beta.2
policy-reporter-ui-v2.0.0-beta.3
policy-reporter-ui-v2.0.0-beta.4
policy-reporter-ui-v2.0.0-beta.5
policy-reporter-ui-v2.0.0-beta.6
policy-reporter-ui-v2.0.0-beta.7
policy-reporter-ui-v2.0.0-beta.8
policy-reporter-ui-v2.0.0-beta.9
Other
test-dev
v0.*
v0.1.0
v0.10.0
v0.11.0
v0.2.0
v0.3.0
v0.4.0
v0.5.0
v0.7.0
v0.7.1
v0.8.0
v0.9.0
v0.9.1
v1.*
v1.0.0
v1.0.0-rc1
v1.1.1
v1.1.10
v1.1.11
v1.1.12
v1.1.2
v1.1.3
v1.1.3-rc1
v1.1.4
v1.1.4-rc1
v1.1.5
v1.1.6
v1.1.6-rc1
v1.1.6-rc2
v1.1.6-rc3
v1.1.6-rc4
v1.1.6-rc5
v1.1.7
v1.1.7-rc1
v1.1.7-rc2
v1.1.7-rc3
v1.1.7-rc4
v1.1.8
v1.1.9
v1.2.0
v1.2.1
v1.3.0
v1.3.0-rc1
v1.3.0-rc10
v1.3.0-rc11
v1.3.0-rc12
v1.3.0-rc2
v1.3.0-rc3
v1.3.0-rc4
v1.3.0-rc5
v1.3.0-rc6
v1.3.0-rc7
v1.3.0-rc8
v1.3.0-rc9
v1.3.1
v1.3.2
v1.3.2-rc1
v1.3.2-rc2
v1.3.2-rc3
v1.3.3
v1.3.4
v1.3.4-rc1
v1.3.5
v1.3.5-rc1
v1.3.5-rc2
v1.3.5-rc3
v1.3.5-rc4
v1.3.5-rc5
v1.3.6
v1.3.6-rc1
v1.3.6-rc2
v1.3.6-rc3
v1.3.6-rc4
v1.3.6-rc5
v1.4.0
v1.4.0-rc1
v1.4.0-rc2
v1.4.0-rc3
v1.4.0-rc4
v1.4.1
v1.4.2
v1.4.2-rc1
v1.4.2-rc2
v1.4.2-rc3
v1.4.2-rc4
v1.4.3
v1.4.3-rc1
v1.4.3-rc2
v1.5.0-rc1
v1.7.0
v1.7.0-rc1
v1.7.0-rc2
v1.7.0-rc3
v1.7.1
v1.7.2-rc1
v1.7.2-rc2
v2.*
v2.0.0
v2.0.0-rc.1
v2.0.0-rc.2
v2.0.0-rc.4
v2.0.0-rc.5
v2.1.0
v2.1.1
v2.1.2
v2.2.0
v2.2.1
v2.3.0
v2.3.0-rc.3
v2.3.10
v2.3.10-dev
v2.3.10-dev.2
v2.3.10-dev.3
v2.3.10-dev.4
v2.3.10-dev.5
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.5-rc.0
v2.3.6
v2.3.7
v2.3.8
v2.3.9
v2.4.0
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44245.json"