Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Keda versions before 2.14.1‑13 can run malicious scripts
published 5 months ago
Summary
The Keda package used in Azure environments can mishandle crafted HTML, allowing attackers to inject and run their own code in a user's browser. This could let a bad actor steal data or manipulate what the user sees. Update Keda to version 2.14.1‑13 or later to fix the issue.
What to do
- Update azure keda to version 2.14.1-13.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Azure Linux:3 | azure | keda |
< 2.14.1-13 Fix: upgrade to 2.14.1-13
|
Original advisory text
CVE-2026-42506 affecting package keda for versions less than 2.14.1-13
Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.
References
Timeline
Published22 May 2026
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-87855 · OSV
Track software like this
Free during beta