CVE-2025-25014: critical vulnerability in Elastic Kibana
Kibana arbitrary code execution via prototype pollution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. It has a public proof of concept.
A flaw in Kibana allows attackers to manipulate how the application creates objects, leading to arbitrary code execution. This happens through specially crafted requests to machine learning and reporting features, letting attackers run any code on the server.
Prototype pollution vulnerability in Kibana's object handling allows attackers to inject malicious properties into prototype chains via crafted HTTP requests to machine learning and reporting endpoints, resulting in arbitrary code execution with server privileges. Attack requires network access to affected endpoints; no authentication bypass is needed if endpoints are exposed.
In the same product, most dangerous first.