Read the docs
TI-2026-32222 Aliases CVE-2026-44245GHSA-q98m-7w8c-w388

Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component

Priority MEDIUM 60CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00183 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed kyverno (kyverno): 2.5.2github.com/kyverno/policy-reporter-ui (Go): 2.5.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
kyvernokyvernobefore 2.5.22.5.2Patch availableCNA
—github.com/kyverno/policy-reporter-ui (Go)before 2.5.22.5.2Patch availableGHSA-q98m-7w8c-w388
  • kyverno Vendorkyverno Affected before 2.5.2 Fixed in 2.5.2 Patch available CNA
  • github.com/kyverno/policy-reporter-ui (Go) Vendor— Affected before 2.5.2 Fixed in 2.5.2 Patch available GHSA-q98m-7w8c-w388

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kyverno:policy-reporter-ui:*:*:*:*:*:*:*:*before 2.5.2Vulnerablekyverno
  • cpe:2.3:a:kyverno:policy-reporter-ui:*:*:*:*:*:*:*:* Versions before 2.5.2 Vulnerable ·kyverno

Remediation

  • Fix · CNA kyverno (kyverno) Fixed in 2.5.2
  • Fix · GHSA-q98m-7w8c-w388 github.com/kyverno/policy-reporter-ui (Go) Fixed in 2.5.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44245
  2. 2026-10-03 Alias added: GHSA-q98m-7w8c-w388

References

Exploit 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences