← Back to browse · API

CVE-2025-25014

Severity
CRITICAL
CVSS
9.1
EPSS
0.21483
Risk score
43.92
CISA KEV
No
PoC
No
Published
2025-05-06
Modified
2026-02-26
First seen
2026-08-07
Aliases
EUVD-2025-13630, GHSA-XPP5-M7FR-WP25
Products
Elastic:Kibana 8.18.0 <8.18.1, Elastic:Kibana 8.3.0 <8.17.6, Elastic:Kibana 9.0.0 <9.0.1
Sources
euvd EUVD-2025-13630

Description

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

References