{"id":"CVE-2025-25009","summary":"Kibana Cross-Site Scripting (XSS)","details":"Improper Neutralization of Input During Web Page Generation in Kibana can lead to Stored XSS via case file upload.","aliases":["BIT-elk-2025-25009","BIT-kibana-2025-25009"],"modified":"2026-08-12T15:13:22.461414Z","published":"2025-10-07T13:59:00.890Z","related":["CGA-6mm3-886h-hfrg"],"database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25009.json"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-18-8-8-19-5-9-0-8-and-9-1-5-security-update-esa-2025-20/382449"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25009.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25009"},{"type":"PACKAGE","url":"https://github.com/elastic/kibana"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"b7e28a7232616c7a21bc879a535d801b8553ba77"},{"fixed":"c1310008a98b8bb63c9fc08e763de1d065b943ce"},{"introduced":"93788a8c2882eb5b606510680fac214cff1c7a22"},{"fixed":"d6dd0417f05cd69706f4f103c69bbb8b7688db9c"},{"introduced":"112859b85d50de2a7e63f73c8fc70b99eea24291"},{"fixed":"936f7cf370e0d7952bb71a98629284c3c0e0d00e"},{"introduced":"00e7d33bf08f1476229d9d1642e2da46cfebdd53"},{"fixed":"90ee222e7e0136dd8ddbb34015538f3a00c129b7"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"},{"introduced":"8.19.0"},{"fixed":"8.19.5"},{"introduced":"9.0.0"},{"fixed":"9.0.8"},{"introduced":"9.1.0"},{"fixed":"9.1.5"}],"source":"CPE_RANGE"}},{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"ee89fda8a17eff9c93f7400c102edf76cb4d7d8a"},{"fixed":"08ece643671f3ee61a7297b3e67aa99e79a1aef7"},{"introduced":"ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf"},{"fixed":"2ceb68bd03a3cc20c26495ec986ed4f244589d69"},{"introduced":"504d6bfa94cca17fabb76e06152c30c4f0c3efdd"},{"fixed":"16276053a4c29c654785bb35bce6b512c15435b1"},{"introduced":"9f30374092edd41719399f7ef81cb7ae78d8a3ab"},{"fixed":"4a62c99c68a5156b84e1bf986d47e0a317591820"}],"database_specific":{"source":"CPE_RANGE","cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"},{"introduced":"8.19.0"},{"fixed":"8.19.5"},{"introduced":"9.0.0"},{"fixed":"9.0.8"},{"introduced":"9.1.0"},{"fixed":"9.1.5"}]}}],"versions":["v9.1.4","v8.19.4","v9.0.7","v8.19.3","v9.1.3","v9.0.6","v9.1.2","v8.19.2","v9.0.5","v8.19.1","v9.1.1","v9.1.0","v8.19.0","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:13:22Z","vanir_signatures":[{"source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultSettingsProvider.java","function":"get"},"deprecated":false,"digest":{"function_hash":"269036682495508372098876363628838406213","length":2072},"id":"CVE-2025-25009-0294f1a7","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextSparseVersionRaisesError"},"deprecated":false,"digest":{"function_hash":"249765765527764254961865193665008504870","length":322},"id":"CVE-2025-25009-06bcb486","signature_type":"Function"},{"source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"createEmbeddingsField"},"deprecated":false,"digest":{"function_hash":"150216485220854256111062364708144529577","length":1475},"id":"CVE-2025-25009-0fe96721","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"validateParserContext"},"deprecated":false,"digest":{"function_hash":"216429141669878661452070393933949020156","length":368},"id":"CVE-2025-25009-127380f2","signature_type":"Function","signature_version":"v1"},{"target":{"function":"testOldIndexSemanticTextMinimalMappingRaisesError","file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"function_hash":"331323253558194736856864026167107843654","length":126},"id":"CVE-2025-25009-19cf7eab","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7"},{"target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["46778459678719198788863574446553221226","227526389465720929596430553628975697304","150049059937223994787476705790433732044","328635304086144337324979246151558935664","238267326037809942089416424725201504926","239127309757472193571684981147742201173","173339703316009130346461748428871974340","320082339657603852603623259741426538034","57118101550255153288139441993827008978","268077932521070584832017352121249000075","102348567805617495592268951805669974975","11265192835822603210162801661360872060","201173388829126597956002296588814084345","337421580536504805651941451209477653214","268075823910593805973861160404908247282","9015906786740215991199765650853684422","266988922029788668281231447512727939898","172758342448755661431055717457301901038","297612526677102816987940982488909026806","210768804027509774644592109719262626729","298123093271431276257578624524763682529","80694905765248191373232040858301348148","51188739959210038594042089674024249861","187947718986999890631599988869822772770","207105469192108996997706200474270770510","151354268564102146974990964996402402639","127423006876670033087290001592727022679","275612146089253582203363595104868195677","51748493963961357519758086343479074559","200549291164040151494825744531332418306","239196964213531434344185265450366252390","329626261930251612650005244598332413438","120105507997745074262955751379832286552","34493630395322261406715696382503445314","16871879890049855732250965867318795550","114692002306916862615727736492928276000","215412353412547025196509663532932782715","335174381897296512391143356609878691466","290996714066872469541389277716815248935","333508862785924981954910392220880037432","277647464754561137415646796304470856322"],"threshold":0.9},"id":"CVE-2025-25009-19dbbb3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce"},{"deprecated":false,"digest":{"line_hashes":["201875432928091695612241281881754528179","292867734803984799864660937495456547324","196659888030505659736611847779352482664","137018670659402653545683123920040464986","292450941474251558568107696200354400924","215295917476798872971081433486924095541","42450885735602859671847586471405895440","235255254753786005465158034200498554465","169763964543134901506960684227268943609","338291239793442998840563304099775590734","261011217116242225010252450501658683247","137413462888448954392976100438474920537","203269082000244051504469967160022759693","291855855030839485975537059720214441018","221312210454151492562525019155621117165","278367177792591368759571815774146042088"],"threshold":0.9},"id":"CVE-2025-25009-2756f2da","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/InternalTestClustersPlugin.java"}},{"id":"CVE-2025-25009-281f6c6f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"parseSemanticTextField"},"deprecated":false,"digest":{"function_hash":"185620469528429678572919397230684044211","length":494}},{"deprecated":false,"digest":{"function_hash":"282459297521231248024296681023376889457","length":1043},"id":"CVE-2025-25009-28ff1259","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java","function":"indexMapping"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"function":"testOldIndexSemanticTextDenseVectorRaisesError","file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"function_hash":"255075628869125026499779058897594092053","length":474},"id":"CVE-2025-25009-37d163d7"},{"target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["262236121079915436119142065679252180905","137777506514668796492329693710738707556","57564652145248143655886175705483546543","114140632291519758601195886058306622434","206061497615943989835368704148231563482","123974211637094905911105515844484307346","202035863791723906355035462524171464328","263579734941057405031723276015520724794"],"threshold":0.9},"id":"CVE-2025-25009-4975358e","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"createEmbeddingsField"},"deprecated":false,"digest":{"function_hash":"151581543923528670693525823811555113136","length":1017},"id":"CVE-2025-25009-5412173f"},{"id":"CVE-2025-25009-56865771","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"parseSemanticTextField"},"deprecated":false,"digest":{"function_hash":"185620469528429678572919397230684044211","length":494}},{"deprecated":false,"digest":{"line_hashes":["201659335253409180137227967538365490900","289297698807500789849272724987309848331","316947341018203027282186092977954478790","328635304086144337324979246151558935664","134985125497845462184671290574117510122","53436638292153261562403264825427102778","84758505728277541116106905481132339224","2483701144709191093784260606111001261","57118101550255153288139441993827008978","268077932521070584832017352121249000075","102348567805617495592268951805669974975","11265192835822603210162801661360872060","201173388829126597956002296588814084345","337421580536504805651941451209477653214","268075823910593805973861160404908247282","9015906786740215991199765650853684422","266988922029788668281231447512727939898","172758342448755661431055717457301901038","297612526677102816987940982488909026806","210768804027509774644592109719262626729","298123093271431276257578624524763682529","80694905765248191373232040858301348148","51188739959210038594042089674024249861","187947718986999890631599988869822772770","207105469192108996997706200474270770510","151354268564102146974990964996402402639","127423006876670033087290001592727022679","275612146089253582203363595104868195677","51748493963961357519758086343479074559","200549291164040151494825744531332418306","239196964213531434344185265450366252390","329626261930251612650005244598332413438","120105507997745074262955751379832286552","34493630395322261406715696382503445314","16871879890049855732250965867318795550","114692002306916862615727736492928276000","215412353412547025196509663532932782715","335174381897296512391143356609878691466","290996714066872469541389277716815248935","333508862785924981954910392220880037432","285581343859421270046665435499666487595"],"threshold":0.9},"id":"CVE-2025-25009-59a95146","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"}},{"id":"CVE-2025-25009-5a6e0e7d","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextDenseVectorRaisesError"},"deprecated":false,"digest":{"function_hash":"255075628869125026499779058897594092053","length":474}},{"digest":{"function_hash":"255075628869125026499779058897594092053","length":474},"id":"CVE-2025-25009-5ad383b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextDenseVectorRaisesError"},"deprecated":false},{"digest":{"function_hash":"331323253558194736856864026167107843654","length":126},"id":"CVE-2025-25009-5bb25224","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextMinimalMappingRaisesError"},"deprecated":false},{"id":"CVE-2025-25009-5dded118","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"boostNotAllowedIndexVersion"},"deprecated":false,"digest":{"function_hash":"304099916769792469380869096030645339333","length":65}},{"target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["158605217801375928217441734668045540378","272643381640331013499760342031064134020","53985671753460806937762457046134928512","197421975884843474782424751932224498632","147776267001273472201702975582528497363","655409951843218362925480034532671518","17637815016842550146136423455960159478","74236008148083372658918307439668483975","322466091450047313375256476185595762444","19774709324117963877378806154921988126","111332465234007377841077556799200761214","318852455395922762541962253784569936542","103714126231198070777385075505723872779","225055423574406139145017039407710500808","176602979872018362860366352636239272391","331685485893499033920803751727008752008","69845433180568037910725362514896432747","288232291348711926876643238346416986777","68055421170270233796912105902769502524","94739273273727563438676562800551104982","84737812370821697998231739337299621986","115294157346707483202906366071384113569","57212282134168748289652182660041201662","254952007036070415382532317368308133681","263203763916969629460590396437502289108","22319423814347326997056951711072005097","23504183291184894397124342894633566955","218290195268039007322983453577677478937","104397057306458966946420455493521049587","108549254030958920501876829102082088797","103602840545713796434731913178477290736","288232291348711926876643238346416986777","304973740810181194951592487929339496300","130999337670170096176664372274476384929","35867540676817589760895459391085052904","207502979453752030282883390595778036424","201606209583253241599127378006426619079","196859472990790294633289504047629811096","217941806944909312076984301808225946554","262692938943554161674911701383004754029","122608929037810719115677381049195131198","266704451184192508078195140547635007709","42779409025487380885093343877669921094","113544207510783995041866812883656149640","300270315494799500913741421782448457144","186309500865517495853234544968794613882","275404729970474416383790431094378410325","52682000639465385863593790108573768318","108301057757930837241470507337700244957","8869584976956833588688363116094065733","320322203024487798382973062775163554140"],"threshold":0.9},"id":"CVE-2025-25009-64cf6848","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce"},{"source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchNode.java","function":"createConfiguration"},"deprecated":false,"digest":{"function_hash":"189247659330120611255899761737295205590","length":3090},"id":"CVE-2025-25009-65aab9a0","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2025-25009-69fd1bb4","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"boostNotAllowedIndexVersion"},"deprecated":false,"digest":{"function_hash":"304099916769792469380869096030645339333","length":65}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"parseSemanticTextField"},"deprecated":false,"digest":{"function_hash":"185620469528429678572919397230684044211","length":494},"id":"CVE-2025-25009-76e75111"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextMinimalMappingRaisesError"},"deprecated":false,"digest":{"length":126,"function_hash":"331323253558194736856864026167107843654"},"id":"CVE-2025-25009-77569fab"},{"digest":{"function_hash":"339286631303545539261800311528141578450","length":788},"id":"CVE-2025-25009-80b98c49","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/InternalTestClustersPlugin.java","function":"apply"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"boostNotAllowedIndexVersion"},"deprecated":false,"digest":{"function_hash":"304099916769792469380869096030645339333","length":65},"id":"CVE-2025-25009-95e8a3ae"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextSparseVersionRaisesError"},"deprecated":false,"digest":{"function_hash":"249765765527764254961865193665008504870","length":322},"id":"CVE-2025-25009-9f87301b"},{"id":"CVE-2025-25009-a1880001","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"createEmbeddingsField"},"deprecated":false,"digest":{"function_hash":"151581543923528670693525823811555113136","length":1017}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["138848391335496439760384072053788624649","272643381640331013499760342031064134020","53985671753460806937762457046134928512","197421975884843474782424751932224498632","147776267001273472201702975582528497363","655409951843218362925480034532671518","17637815016842550146136423455960159478","74236008148083372658918307439668483975","322466091450047313375256476185595762444","19774709324117963877378806154921988126","111332465234007377841077556799200761214","318852455395922762541962253784569936542","103714126231198070777385075505723872779","225055423574406139145017039407710500808","176602979872018362860366352636239272391","331685485893499033920803751727008752008","69845433180568037910725362514896432747","288232291348711926876643238346416986777","68055421170270233796912105902769502524","94739273273727563438676562800551104982","84737812370821697998231739337299621986","115294157346707483202906366071384113569","57212282134168748289652182660041201662","254952007036070415382532317368308133681","263203763916969629460590396437502289108","22319423814347326997056951711072005097","23504183291184894397124342894633566955","218290195268039007322983453577677478937","104397057306458966946420455493521049587","108549254030958920501876829102082088797","103602840545713796434731913178477290736","288232291348711926876643238346416986777","304973740810181194951592487929339496300","130999337670170096176664372274476384929","35867540676817589760895459391085052904","207502979453752030282883390595778036424","201606209583253241599127378006426619079","196859472990790294633289504047629811096","217941806944909312076984301808225946554","262692938943554161674911701383004754029","122608929037810719115677381049195131198","266704451184192508078195140547635007709","42779409025487380885093343877669921094","113544207510783995041866812883656149640","300270315494799500913741421782448457144","186309500865517495853234544968794613882","275404729970474416383790431094378410325","52682000639465385863593790108573768318","108301057757930837241470507337700244957","8869584976956833588688363116094065733","320322203024487798382973062775163554140"],"threshold":0.9},"id":"CVE-2025-25009-a400b225"},{"source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["181320571600198418982009240539939798543","169287320765032099154665842823281563426","206141912844909897609368796238279101654","79522924381762417070909548166485907047","206061497615943989835368704148231563482","123974211637094905911105515844484307346","202035863791723906355035462524171464328","180092483531318306332375103048816107448"]},"id":"CVE-2025-25009-aaca87f1","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"assertOldIndexUnsupported"},"deprecated":false,"digest":{"function_hash":"192095868591587962532804350088891814436","length":331},"id":"CVE-2025-25009-bac55aa9","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"216429141669878661452070393933949020156","length":368},"id":"CVE-2025-25009-bc497222","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"validateParserContext"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["145152996910083025882365213578824959031","2676960805448399036476663589235584911","262554611364329333534925155494228851048","109827329768022785387218720610747300115"],"threshold":0.9},"id":"CVE-2025-25009-c68f6650","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"test/test-clusters/src/main/java/org/elasticsearch/test/cluster/local/DefaultSettingsProvider.java"}},{"target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"assertOldIndexUnsupported"},"deprecated":false,"digest":{"function_hash":"192095868591587962532804350088891814436","length":331},"id":"CVE-2025-25009-d26afbef","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e"},{"source":"https://github.com/elastic/elasticsearch/commit/d6dd0417f05cd69706f4f103c69bbb8b7688db9c","target":{"file":"build-tools/src/main/java/org/elasticsearch/gradle/testclusters/ElasticsearchNode.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["145160648915801089826981904625537909257","42983940649290099585203735755069991189","259042419839513735390215506938370160568","53523156721841588313300745469212558097","7034715473439696607992318865238676731"]},"id":"CVE-2025-25009-db7ba1a9","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["158605217801375928217441734668045540378","272643381640331013499760342031064134020","53985671753460806937762457046134928512","197421975884843474782424751932224498632","147776267001273472201702975582528497363","655409951843218362925480034532671518","17637815016842550146136423455960159478","74236008148083372658918307439668483975","322466091450047313375256476185595762444","19774709324117963877378806154921988126","111332465234007377841077556799200761214","318852455395922762541962253784569936542","103714126231198070777385075505723872779","225055423574406139145017039407710500808","176602979872018362860366352636239272391","331685485893499033920803751727008752008","69845433180568037910725362514896432747","288232291348711926876643238346416986777","68055421170270233796912105902769502524","94739273273727563438676562800551104982","84737812370821697998231739337299621986","115294157346707483202906366071384113569","57212282134168748289652182660041201662","254952007036070415382532317368308133681","263203763916969629460590396437502289108","22319423814347326997056951711072005097","23504183291184894397124342894633566955","218290195268039007322983453577677478937","104397057306458966946420455493521049587","108549254030958920501876829102082088797","103602840545713796434731913178477290736","288232291348711926876643238346416986777","304973740810181194951592487929339496300","130999337670170096176664372274476384929","35867540676817589760895459391085052904","207502979453752030282883390595778036424","201606209583253241599127378006426619079","196859472990790294633289504047629811096","217941806944909312076984301808225946554","262692938943554161674911701383004754029","122608929037810719115677381049195131198","266704451184192508078195140547635007709","42779409025487380885093343877669921094","113544207510783995041866812883656149640","300270315494799500913741421782448457144","186309500865517495853234544968794613882","275404729970474416383790431094378410325","52682000639465385863593790108573768318","108301057757930837241470507337700244957","8869584976956833588688363116094065733","320322203024487798382973062775163554140"],"threshold":0.9},"id":"CVE-2025-25009-e273a1bd","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java","function":"indexMapping"},"deprecated":false,"digest":{"function_hash":"37651411927726833078118660564704242750","length":1559},"id":"CVE-2025-25009-ed1c2bf3","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextSparseVersionRaisesError"},"deprecated":false,"digest":{"function_hash":"249765765527764254961865193665008504870","length":322},"id":"CVE-2025-25009-f11fdf3e"},{"source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"},"deprecated":false,"digest":{"line_hashes":["201659335253409180137227967538365490900","289297698807500789849272724987309848331","316947341018203027282186092977954478790","328635304086144337324979246151558935664","238267326037809942089416424725201504926","239127309757472193571684981147742201173","173339703316009130346461748428871974340","320082339657603852603623259741426538034","57118101550255153288139441993827008978","268077932521070584832017352121249000075","102348567805617495592268951805669974975","11265192835822603210162801661360872060","201173388829126597956002296588814084345","337421580536504805651941451209477653214","268075823910593805973861160404908247282","9015906786740215991199765650853684422","266988922029788668281231447512727939898","172758342448755661431055717457301901038","297612526677102816987940982488909026806","210768804027509774644592109719262626729","298123093271431276257578624524763682529","80694905765248191373232040858301348148","51188739959210038594042089674024249861","187947718986999890631599988869822772770","207105469192108996997706200474270770510","151354268564102146974990964996402402639","127423006876670033087290001592727022679","275612146089253582203363595104868195677","51748493963961357519758086343479074559","200549291164040151494825744531332418306","239196964213531434344185265450366252390","329626261930251612650005244598332413438","120105507997745074262955751379832286552","34493630395322261406715696382503445314","16871879890049855732250965867318795550","114692002306916862615727736492928276000","215412353412547025196509663532932782715","335174381897296512391143356609878691466","290996714066872469541389277716815248935","333508862785924981954910392220880037432","277647464754561137415646796304470856322"],"threshold":0.9},"id":"CVE-2025-25009-f599795d","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"192095868591587962532804350088891814436","length":331},"id":"CVE-2025-25009-f79eb048","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/90ee222e7e0136dd8ddbb34015538f3a00c129b7","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"assertOldIndexUnsupported"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/936f7cf370e0d7952bb71a98629284c3c0e0d00e","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"validateParserContext"},"deprecated":false,"digest":{"function_hash":"216429141669878661452070393933949020156","length":368},"id":"CVE-2025-25009-ff78991f"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25009.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N"}]}