Vulnerability Description
Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and injects the resulting HTML with Vue’s v-html without sanitisation. At time of publication, there are no publicly available patches.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kestra | Kestra | <= 1.1.10 |
Related Weaknesses (CWE)
References
- https://github.com/kestra-io/kestra/releases/tag/v1.0.30ProductRelease Notes
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r36c-83hm-pc8jExploitVendor Advisory
- https://github.com/kestra-io/kestra/security/advisories/GHSA-r36c-83hm-pc8jExploitVendor Advisory
FAQ
What is CVE-2026-29082?
CVE-2026-29082 is a vulnerability with a CVSS score of 7.3 (HIGH). Kestra is an event-driven orchestration platform. In versions from 1.1.10 and prior, Kestra’s execution-file preview renders user-supplied Markdown (.md) with markdown-it instantiated as html:true and...
How severe is CVE-2026-29082?
CVE-2026-29082 has been rated HIGH with a CVSS base score of 7.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29082?
Check the references section above for vendor advisories and patch information. Affected products include: Kestra Kestra.