Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom [[link]] syntax, causing stored cross-site scripting when another user opens the description or information panel in the Flow list. This issue is fixed in version 1.3.24.

Affected: Maven: io.kestra:kestra

## Summary

Kestra’s Markdown renderer supports a custom `[[link ...]]` syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization.

As a result, a user who can create or edit Markdown-rendered content, such as a Flow description, can inject JavaScript event-handler attributes. When another user views or interacts with the affected Markdown-rendered UI element, the JavaScript executes in that user’s browser.

This is not a normal raw-HTML Markdown payload such as `<img onerror=...>`. The payload uses Kestra’s custom `[[link]]` Markdown syntax, and the dangerous HTML attributes are introduced by Kestra’s own Markdown plugin.

## Affected version

Tested on Kestra `1.3.22`.

## Affected components

Source review identified the issue in the custom Markdown link renderer:

* `ui/src/utils/markdown_plugins/link.ts` * `ui/src/utils/markdown.ts` * `ui/src/components/layout/Markdown.vue`

The vulnerable code path renders parsed attributes directly into an HTML string:

```ts const attrs = token.attrs ? token.attrs.map(([name, value]) => `${name}="${value}"`).join("") : "";

return `<router-md ${attrs}>`; ```

The implementation does not safely restrict attribute names or values before inserting the generated HTML into the DOM.

## Proof of concept

Create or edit a Flow with the following YAML:

```yaml id: markdown_xss_flow_desc namesp…