CVE-2026-55839: Kestra vulnerable to stored XSS via custom Markdown [[link]] attribute injection

Kestra’s Markdown renderer supports a custom [[link ...]] syntax that is converted into a custom HTML element. The custom Markdown parser allows attacker-controlled attributes to be rendered into the generated element without proper allowlisting or sanitization.

As a result, a user who can create or edit Markdown-rendered content, such as a Flow description, can inject JavaScript event-handler attributes. When another user views or interacts with the affected Markdown-rendered UI element, the JavaScript executes in that user’s browser.

This is not a normal raw-HTML Markdown payload such as <img onerror=...>. The payload uses Kestra’s custom [[link]] Markdown syntax, and the dangerous HTML attributes are introduced by Kestra’s own Markdown plugin.