{"id":"CVE-2021-37936","details":"It was discovered that Kibana was not sanitizing document fields containing HTML snippets. Using this vulnerability, an attacker with the ability to write documents to an elasticsearch index could inject HTML. When the Discover app highlighted a search term containing the HTML, it would be rendered for the user.","modified":"2026-07-09T05:44:44.074712Z","published":"2022-11-18T23:15:19.060Z","references":[{"type":"ADVISORY","url":"https://discuss.elastic.co/t/elastic-stack-7-14-1-security-update/283077"},{"type":"ADVISORY","url":"https://www.elastic.co/community/security/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"0"},{"fixed":"66b55ebfa59c92c15db3f69a335d500018b3331e"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.14.1"}],"source":"CPE_RANGE"}}],"versions":["v7.14.0","v7.0.0-alpha2","v7.0.0-alpha1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37936.json","vanir_signatures_modified":"2026-07-09T05:44:44Z","vanir_signatures":[{"source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloader.java"},"deprecated":false,"digest":{"line_hashes":["43294031746314926808366686240993485436","72129461379004843922361447629433292739","299165755059523955650530030949892518246","320210725232441693312032919881270238173","293303421246874422341572304132211700069","58470013856907099080964870509330781875","296999303062807072169658683471145993999","300591473658675280601341069790004290678","160188011084836964071373289530966569573","143233807439995617848796493011994450856","6350947991896534955236864498512922585","237982936089500951464304433795246576"],"threshold":0.9},"id":"CVE-2021-37936-1f3d38a5","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"123008238293448310980674592781724958548","length":336},"id":"CVE-2021-37936-43ea594e","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java","function":"setEnabled"}},{"deprecated":false,"digest":{"function_hash":"260663371080659251893305562102741669443","length":564},"id":"CVE-2021-37936-5b8218ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloader.java","function":"GeoIpDownloader"}},{"digest":{"function_hash":"123277663807363208651257303326478525497","length":245},"id":"CVE-2021-37936-5c4d153f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java","function":"clusterChanged"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"},"deprecated":false,"digest":{"line_hashes":["291110225617448284938680460363260256557","141322434359827214491010619852413737624","18722184183482606797300801913160473935","84759085196698385649541736620428937369","330736549659086272716201033219146970443","78938860815427841495704971172327648809","285329995835112589973388027222669394563","308421632650885990509851682624100988750","303805532460993261979200839405425225042","5328311121646375897315212467096655922","112968698024351385830166669336685651681","281215882580579346575059810248021011719","319189154037564604934153396664531384113","149228605690654109618796387525272814806","312703810024447475870610295586135527405","158289000336674805338813453430308797437","275273013179566745131735790247575047584","290562535040322731431913367590119185031","170283097830717693710483563365076558732","274535963129894068371486967338432527913","141256808549946728103583726782147456903","39829565313391319809867072905663955397","117841172245403898421918867895955408564","309893578793894113566889101490578155085","9088804385998371460488616185024685970","77162977922016855688716612164253048516","287212268032535206145107662754875763708","78657904124391617966875539569913380237","266134255359683549727298029806145014753","320917847787903113653131708863413722636","230838848098826085779033406560455529229","7190067002162824531458144305361982292","143427756424031091036021574847113415950","215953566906267560006086642159505105876","112979444913582689794012941559410702716","89195688825346920342376358263314388443","43238398256300634246693563742953588208","10333928841560312002208969018516952856","79888031617470547464557005022838001819","292060965530350989376832212592275356366","287348193867920464580007650220885527509","230557132420537145711011838631804784031","9034221530883613317087008010030791152","274388618104218543508567763726510483529","128148356571720265980502854100028628708","58510716701492134555691472698889597316","150244817892521442448313353254543857320","60519532783079146443603676488130403839","171124365331192943670559863338206056437","66560627416304229224651317592802479305","204532021424519538519357313830239766201","45066071883776509565833363839531387162"],"threshold":0.9},"id":"CVE-2021-37936-6d7e4268"},{"deprecated":false,"digest":{"function_hash":"180057013320988624966896474695678749292","length":233},"id":"CVE-2021-37936-eae83c1a","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java","function":"nodeOperation"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/66b55ebfa59c92c15db3f69a335d500018b3331e","target":{"function":"GeoIpDownloaderTaskExecutor","file":"modules/ingest-geoip/src/main/java/org/elasticsearch/ingest/geoip/GeoIpDownloaderTaskExecutor.java"},"deprecated":false,"digest":{"function_hash":"52233103973581432341793139102182098894","length":478},"id":"CVE-2021-37936-f56dfdd1"}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"0"},{"fixed":"196ec3974d4c725a3d937725419e5ed7d8fdb104"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"7.14.1"}],"source":"CPE_RANGE"}}],"versions":["v7.14.0","v7.0.0-alpha2","v7.0.0-alpha1","7.0-known-good","v6.0.0-alpha2","v6.0.0-alpha1","v5.0.0-alpha5","v4.2.0-beta1","v4.0.0-beta3","v4.0.0-beta2","v4.0.0-beta1.1","v4.0.0-beta1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-37936.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}]}