CVE-2025-53543

{"id": "CVE-2025-53543", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.6}]}, "published": "2025-07-07T20:15:28.323", "references": [{"url": "https://github.com/kestra-io/kestra/security/advisories/GHSA-qpj4-4r6r-wvf4", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Kestra is an event-driven orchestration platform. The error message in execution \"Overview\" tab is vulnerable to stored XSS due to improper handling of HTTP response received. This vulnerability is fixed in 0.22.0."}, {"lang": "es", "value": "Kestra es una plataforma de orquestaci\u00f3n basada en eventos. El mensaje de error en la pesta\u00f1a \"Overview\" de la ejecuci\u00f3n es vulnerable a XSS almacenado debido al manejo incorrecto de la respuesta HTTP recibida. Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 0.22.0."}], "lastModified": "2025-07-08T16:18:34.923", "sourceIdentifier": "security-advisories@github.com"}