{"id":"CVE-2025-25014","summary":"Kibana arbitrary code execution via prototype pollution","details":"A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.","aliases":["BIT-elk-2025-25014","BIT-kibana-2025-25014"],"modified":"2026-08-12T14:52:32.389647Z","published":"2025-05-06T17:30:45.197Z","database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25014.json"},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-17-6-8-18-1-or-9-0-1-security-update-esa-2025-07/377868"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25014.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25014"},{"type":"PACKAGE","url":"https://github.com/elastic/kibana"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"5b8b981647acdf1ba1d88751646b49d1b461b4cc"},{"fixed":"dbcbbbd0bc4924cfeb28929dc05d82d662c527b7"},{"introduced":"04e979aa50b657bebd4a0937389308de82c2bdad"},{"last_affected":"112859b85d50de2a7e63f73c8fc70b99eea24291"}],"database_specific":{"cpe":["cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:9.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.3.0"},{"fixed":"8.17.6"},{"introduced":"8.18.0"},{"last_affected":"8.18.0"},{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}},{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"8a54c809495bc08782359073d9392f25c8eb6499"},{"fixed":"28847d93343b5a3adfb1bcb953866a6705ab746f"},{"introduced":"c220d2938cd718bb332afb07baaf95999eb28759"},{"last_affected":"504d6bfa94cca17fabb76e06152c30c4f0c3efdd"}],"database_specific":{"cpe":["cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:8.18.0:*:*:*:*:*:*:*","cpe:2.3:a:elastic:kibana:9.0.0:-:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.3.0"},{"fixed":"8.17.6"},{"introduced":"8.18.0"},{"last_affected":"8.18.0"},{"introduced":"9.0.0-NA"},{"last_affected":"9.0.0-NA"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["8.18.0","9.0.0-NA"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25014.json","vanir_signatures_modified":"2026-08-12T14:52:32Z","vanir_signatures":[{"digest":{"function_hash":"155988868032570604689205509621145303938","length":826},"id":"CVE-2025-25014-2056b06f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7","target":{"file":"x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java","function":"guessMappingsAndCalculateFieldStats"},"deprecated":false},{"target":{"file":"x-pack/plugin/text-structure/src/test/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtilsTests.java"},"deprecated":false,"digest":{"line_hashes":["103062777601327816001532191706242182431","211766124421928476690457691246930073396","109357362993875544563704018619993770016"],"threshold":0.9},"id":"CVE-2025-25014-2d075337","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7"},{"deprecated":false,"digest":{"line_hashes":["106213297097279866768185910228201675810","314168248095395219328740139850914297886","119162934123016417405811605557729668362","39859272969510159055531249577201918212","244933187160039656490785231674378323577","234077450779033024857046981396487847380","93436833372906784425240664014202993134","202381044633269865317511751622544903898","254831802349912243738659411130675016589","120183324559202470104653390017387002778","180925524410113248638112654699035780330","102344227782104906477873574944152304516"],"threshold":0.9},"id":"CVE-2025-25014-6f51145d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7","target":{"file":"x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java"}},{"target":{"file":"x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java","function":"guessMappingAndCalculateFieldStats"},"deprecated":false,"digest":{"function_hash":"66582372798516181147542140247763769422","length":1112},"id":"CVE-2025-25014-cf8bab70","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"}]}