CVE-2025-25014

Name of the Vulnerable Software and Affected Versions Kibana versions 8.3.0 through 8.17.5 Kibana version 8.18.0

Description A prototype pollution flaw allows remote attackers to achieve arbitrary code execution. This occurs when the software fails to properly control the modification of object prototype attributes. The issue is triggered by sending specially crafted HTTP requests to the machine learning and reporting endpoints. Prototype pollution is a technique where an attacker manipulates the base prototype of an object to inject properties that can alter the behavior of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.