CVE-2026-44245 Details
Description
Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.
A cross-site scripting (XSS) vulnerability has been identified in the Kyverno Policy Reporter UI component prior to version 2.5.1. The issue arises in the PropertyCard.vue component, which uses Vue 3's v-html directive to inject raw HTML into the DOM. This implementation bypasses the framework's built-in auto-escaping, allowing non-URL string values to be interpreted as HTML. The vulnerability exploits the isURL() guard, which only filters strings that begin with 'http:' or 'https:'. As a result, any HTML payload not adhering to these schemes can be injected, potentially executing malicious scripts in the context of the user's browser session. The exploited data comes from Kubernetes PolicyReport properties, which can be manipulated by users with write access to PolicyReport objects in the cluster.
Users can update to Kyverno Policy Reporter UI version 2.5.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| kyverno policy-reporter-ui | < 2.5.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 26, 2026 | Initial Analysis | [email protected] |
| May 13, 2026 | CVE Modified | CISA-ADP |
| May 12, 2026 | New CVE Received | [email protected] |