Stored XSS via link attribute injection

Stored XSS in Flow descriptions in Kestra before 1.3.24 allows remote authenticated users to execute script in another user's browser. Kestra's custom Markdown link renderer in ui/src/utils/markdown_plugins/link.ts copied parsed [[link]] attributes into generated HTML and, before the fix, did not restrict attribute names beyond basic parsing, allowing event-handler attributes such as onmouseover to reach the rendered router-md element. Exploitation requires permission to create or update a Flow description and a second user to open the description or information panel; the injected script then runs with the viewer's Kestra UI access and can read visible data or perform actions as that user.