Kibana arbitrary code execution via prototype pollution

A flaw in Kibana allows attackers to manipulate how the application creates objects, leading to arbitrary code execution. This happens through specially crafted requests to machine learning and reporting features, letting attackers run any code on the server.

Prototype pollution vulnerability in Kibana's object handling allows attackers to inject malicious properties into prototype chains via crafted HTTP requests to machine learning and reporting endpoints, resulting in arbitrary code execution with server privileges. Attack requires network access to affected endpoints; no authentication bypass is needed if endpoints are exposed.