CVE-2025-25014

Kibana arbitrary code execution via prototype pollution

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Affected

Elastic · Kibana

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 ELASTIC

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS

22.35% chance of exploitation in the next 30 days, 98th percentile

Published

2025-05-06

Updated

2026-02-26

Proof-of-concept exploits (1)

• davidxbors/CVE-2025-250141★ · 2025-05-24

Security advisories

• https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/37…

References

• CVE Record
• NVD entry

Related

• CVE-2023-47504
• CVE-2024-7399