CVE-2025-25014
Kibana arbitrary code execution via prototype pollution
Summary
Kibana arbitrary code execution via prototype pollution
Original description
The description as published by the source.
A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.
Affected packages
Bitnami
elk
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.18.1"},{"introduced":"9.0.0"},{"fixed":"9.0.1"}]}]
Bitnami
kibana
[{"type":"SEMVER","events":[{"introduced":"8.3.0"},{"fixed":"8.17.6"},{"introduced":"8.18.0"},{"fixed":"8.17.10"},{"introduced":"9.0.0"},{"fixed":"9.0.1"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.elastic.co