Kestra Stored Cross-Site Scripting Vulnerability in Markdown File Preview

A stored cross-site scripting vulnerability has been identified in Kestra, an event-driven orchestration platform, in versions through 1.1.10. The issue arises because the execution-file preview feature renders user-supplied Markdown files with 'markdown-it' configured to allow HTML. This unfiltered HTML is then injected into the application using Vue's 'v-html' directive, creating an opportunity for malicious scripts to be executed. At the time of publication, no patches are available.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, create a flow in Kestra that writes a malicious Markdown file, 'xss.md', containing a script payload, such as an image tag with an 'onerror' attribute. After executing the flow, the injected script will execute when the Markdown preview is rendered.