CVE-2026-44245

描述

Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to 2.5.2, Vue 3's v-html directive is the framework-documented mechanism for injecting raw HTML, and it intentionally disables the auto-escaping that {{ }} interpolation provides. The PropertyCard.vue component uses v-html for the else branch of the URL check, meaning any non-URL string value flows directly into the DOM as HTML. The isURL() guard only filters values that parse as http: or https: URLs, so any HTML payload not starting with those schemes bypasses it entirely. The data originates from Kubernetes PolicyReport .results[].properties fields, which are arbitrary string maps populated by policy engines and potentially by any principal with write access to PolicyReport objects in the cluster. This vulnerability is fixed in 2.5.2.

如何修補 CVE-2026-44245

要修補 CVE-2026-44245,請將受影響套件升級到下列已修補版本。

• —升級至 2.5.2 或更新版本
• —升級至 2.5.2 或更新版本
• —升級至 2.5.2+incompatible 或更新版本

CVE-2026-44245 正在被利用嗎?

低 — EPSS 為 0.2%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.5.2
• from 0, < 2.5.2
• from 0, < 2.5.2+incompatible

CVSS 分數

參考連結(3)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-44245
• PATCHgithub.com/kyverno/kyverno
• WEBgithub.com/kyverno/kyverno/security/advisories/GHSA-q98m-7w8c-w388