💸 Elastic has released security updates to address a critical vulnerability in its Kibana data visualization software

[chushpan]

Elastic has released security updates to address a critical vulnerability in its Kibana data visualization software for Elasticsearch that could lead to arbitrary code execution.

The vulnerability, tracked as CVE-2025-25012, has a CVSS score of 9.9 out of a maximum of 10.0. It has been described as a prototype pollution incident.

“Prototype pollution in Kibana leads to arbitrary code execution via forged file uploads and specially crafted HTTP requests”, the company said in a statement on Wednesday.

Prototype pollution is a security flaw that allows attackers to manipulate an application’s JavaScript objects and properties, potentially leading to unauthorized data access, privilege escalation, denial of service, or remote code execution.

The vulnerability affects all versions of Kibana between 8.15.0 and 8.17.3. It was fixed in version 8.17.3.