Vulnerability · Published May 12, 2026 · Assigned by GitHub_M

CVE-2026-44245Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component

Medium 6.1

In plain English

A medium-severity cross-site scripting in kyverno from kyverno. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.2%top 92.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kyverno/policy-reporter-ui	2.5.2	GHSA-q98m-7w8c-w388
Go	github.com/kyverno/policy-reporter-ui	2.5.2+incompatible	GO-2026-5577

Affected products (as reported)

Vendor	Product	Versions
kyverno	kyverno	< 2.5.2

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

https://github.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388 x_refsource_CONFIRM