Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection
Kestra’s Markdown renderer supports a custom [[link …]] syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization. As a result, a user who can create or edit Markdown-rendered content, such as a Flow description, can inject JavaScript event-handler attributes. When another user views or interacts with the affected Markdown-rendered UI element, …