{"cve":"CVE-2026-44245","nvd":{"published":"2026-05-12T23:16:18.060","modified":"2026-06-17T10:50:24.460","status":"Analyzed","description":"Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79"],"references":["https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388","https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388"],"products":["kyverno:policy-reporter-ui"],"source":"nvd","synced_at":"2026-10-19T22:35:16.954578616+00:00"},"epss":{"cve":"CVE-2026-44245","score":0.00183,"percentile":0.07894,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-q98m-7w8c-w388","url":"https://osv.dev/vulnerability/GHSA-q98m-7w8c-w388","summary":"Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component","modified":"2026-09-10T03:50:55.282219601Z","packages":[{"ecosystem":"Go","name":"github.com/kyverno/policy-reporter-ui","purl":"pkg:golang/github.com/kyverno/policy-reporter-ui","ranges":["<2.5.2"],"fixed":["2.5.2"]}]},{"id":"GO-2026-5577","url":"https://osv.dev/vulnerability/GO-2026-5577","summary":"Kyverno policy-reporter-ui has XSS via Stored Property Values in PropertyCard Component in github.com/kyverno/policy-reporter-ui","modified":"2026-06-25T23:11:06.265507991Z","packages":[{"ecosystem":"Go","name":"github.com/kyverno/policy-reporter-ui","purl":"pkg:golang/github.com/kyverno/policy-reporter-ui","ranges":["<2.5.2+incompatible"],"fixed":["2.5.2+incompatible"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}