CVE-2026-33664 affects Kestra, an open-source event-driven orchestration platform. Versions up to 1.3.3 are vulnerable to XSS attacks through unsanitized user-supplied YAML metadata fields. The vulnerability allows flow authors to inject arbitrary JavaScript that executes in browsers of users viewing the flow. The issue stems from the Markdown.vue component rendering HTML without sanitization via Vue's v-html. This represents a zero-click attack vector for input.displayName fields. The vulnerability is distinct from CVE-2026-29082 and affects different components with less user interaction required.