R0Binak

**Name of the Vulnerable Software and Affected Versions** Kyverno versions prior to 2.5.2 **Description** The PropertyCard.vue component uses the Vue 3 `v-html` directive, which injects raw HTML and disables auto-escaping. The `isURL()` function only filters values that parse as http: or https: URLs, allowing any HTML payload not starting with those schemes to bypass the guard and flow directly into the DOM. The affected data originates from Kubernetes PolicyReport `.results[].properties` fields, which are arbitrary string maps that can be populated by policy engines or any principal with write access to PolicyReport objects in the cluster. **Recommendations** Update to version 2.5.2.

**Name of the Vulnerable Software and Affected Versions** Kyverno versions v1.9.0 through v1.12.7 **Description** A flaw exists in the policy exception handling when a policy is set to enforce mode and combined with two PolicyExceptions. The system incorrectly allows a less restrictive exception to take precedence over a stricter one. An attacker can bypass policy enforcement, such as restrictions on hostPath volumes, by crafting a resource name that matches the broader exception pattern (e.g., `*ingress*`). **Recommendations** Update Kyverno to version v1.13.0.

**Name of the Vulnerable Software and Affected Versions** Kyverno versions prior to 1.13.4 **Description** Server-side request forgery (SSRF) exists within the Service Call functionality. An attacker with permissions to create Kyverno (Cluster)Policies can specify an external URL in the `apiCall/service` configuration. While the Service Call is intended for in-cluster services, it also resolves external addresses, enabling requests to be sent to an attacker-controlled server. This allows for the exfiltration of sensitive cluster data, including the contents of Kubernetes resources such as secrets, which are included in the policy context data sent during these requests. **Recommendations** Update to version 1.13.4 or later.