CVE-2025-53543 MEDIUM

CVE-2025-53543: Kestra allows Stored XSS before 0.22

Vendor Kestra-Io

Product kestra

Weakness CWE-79 · XSS

Published July 7, 2025

Last update July 7, 2025

View on NVD All CVEs

CVSS base score

4.2/10

Attack vector Local

Attack complexity Low

Privileges required High

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0.

Key dates

02Disclosure timeline

July 7, 2025 CVE published

July 7, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-53543 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2024-27969 WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability CVE-2025-13988 评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF'] CVE-2019-1802 Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability CVE-2025-42956 Multiple vulnerabilities in SAP NetWeaver Application Server ABAP CVE-2025-7840 Campcodes Online Movie Theater Seat Reservation System Reserve Your Seat Page index.php cross site scripting