CVE-2025-25014

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Scoring

Severity

CRITICAL

CVSS base score

9.1

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

EPSS probability

21.48%

CWE

CWE-1321

Published

2025-05-06

Last modified

2026-03-12

Affected products

• Elastic Kibana
• Elastic Kibana
• Elastic Kibana

Weakness type

• CWE-1321

Related vulnerabilities

• CVE-2026-86078 — n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of Service
• CVE-2026-81994 — Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)
• CVE-2026-85625 — sift 17.1.3 Prototype Pollution Remote Code Execution via $where
• CVE-2026-63376 — toml-node: Prototype Pollution Leads to `Object.prototype` Corruption via `__proto__` Key-Path Desynchronization
• CVE-2026-85063 — node-csv: Prototype replacement still reachable via columns path
• CVE-2026-82404 — TOON: Prototype pollution when decoding untrusted TOON input
• CVE-2026-84368 — joi: Prototype pollution via a `__proto__` language key in custom messages
• CVE-2026-84367 — joi: object().rename() with a template target can set the validated object's prototype

Markdown version · Browse all CVEs