CVE-2025-25014 — Kibana arbitrary code execution via prototype pollution

CVE-2025-25014

Kibana arbitrary code execution via prototype pollution PUBLISHED

Description (CNA)

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Affected (CNA)

Vendor / product	Versions
Elastic / Kibana	affected 8.3.0 before 8.17.6; affected 8.18.0 before 8.18.1; affected 9.0.0 before 9.0.1

CWE

CWE-1321

References

https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.