{"id":"CVE-2025-25017","summary":"Kibana Stored Cross-Site Scripting (XSS)","details":"Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting (XSS)","aliases":["BIT-elk-2025-25017","BIT-kibana-2025-25017"],"modified":"2026-08-12T15:16:18.025537Z","published":"2025-10-10T09:53:25.634Z","related":["CGA-xccg-qw74-rwcj"],"database_specific":{"cna_assigner":"elastic","cwe_ids":["CWE-79"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25017.json","unresolved_ranges":[{"extracted_events":[{"introduced":"7.0.0"},{"last_affected":"7.17.29"},{"introduced":"8.0.0"},{"last_affected":"8.18.7"},{"introduced":"8.19.0"},{"last_affected":"8.19.3"},{"introduced":"9.0.0"},{"last_affected":"9.0.6"},{"introduced":"9.1.0"},{"last_affected":"9.1.3"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://discuss.elastic.co/t/kibana-8-18-8-8-19-4-9-0-7-9-1-4-security-update-esa-2025-16/382450"},{"type":"WEB","url":"https://github.com/kibana"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25017.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-25017"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/elasticsearch","events":[{"introduced":"b7e28a7232616c7a21bc879a535d801b8553ba77"},{"fixed":"c1310008a98b8bb63c9fc08e763de1d065b943ce"},{"introduced":"93788a8c2882eb5b606510680fac214cff1c7a22"},{"fixed":"aa0a7826e719b392e7782716b323c4fb8fa3b392"},{"introduced":"112859b85d50de2a7e63f73c8fc70b99eea24291"},{"fixed":"c6d8fb31b39450a223671e79141dd1c4b2759b5f"},{"introduced":"00e7d33bf08f1476229d9d1642e2da46cfebdd53"},{"fixed":"0b7fe68d2e369469ff9e9f344ab6df64ab9c5293"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"},{"introduced":"8.19.0"},{"fixed":"8.19.4"},{"introduced":"9.0.0"},{"fixed":"9.0.7"},{"introduced":"9.1.0"},{"fixed":"9.1.4"}],"source":"CPE_RANGE"}}],"versions":["v8.19.3","v9.1.3","v9.0.6","v9.1.2","v8.19.2","v9.0.5","v8.19.1","v9.1.1","v9.1.0","v8.19.0","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25017.json","vanir_signatures_modified":"2026-08-12T15:16:18Z","vanir_signatures":[{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextSparseVersionRaisesError"},"deprecated":false,"digest":{"function_hash":"249765765527764254961865193665008504870","length":322},"id":"CVE-2025-25017-06bcb486","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"validateParserContext"},"deprecated":false,"digest":{"function_hash":"216429141669878661452070393933949020156","length":368},"id":"CVE-2025-25017-127380f2","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["46778459678719198788863574446553221226","227526389465720929596430553628975697304","150049059937223994787476705790433732044","328635304086144337324979246151558935664","238267326037809942089416424725201504926","239127309757472193571684981147742201173","173339703316009130346461748428871974340","320082339657603852603623259741426538034","57118101550255153288139441993827008978","268077932521070584832017352121249000075","102348567805617495592268951805669974975","11265192835822603210162801661360872060","201173388829126597956002296588814084345","337421580536504805651941451209477653214","268075823910593805973861160404908247282","9015906786740215991199765650853684422","266988922029788668281231447512727939898","172758342448755661431055717457301901038","297612526677102816987940982488909026806","210768804027509774644592109719262626729","298123093271431276257578624524763682529","80694905765248191373232040858301348148","51188739959210038594042089674024249861","187947718986999890631599988869822772770","207105469192108996997706200474270770510","151354268564102146974990964996402402639","127423006876670033087290001592727022679","275612146089253582203363595104868195677","51748493963961357519758086343479074559","200549291164040151494825744531332418306","239196964213531434344185265450366252390","329626261930251612650005244598332413438","120105507997745074262955751379832286552","34493630395322261406715696382503445314","16871879890049855732250965867318795550","114692002306916862615727736492928276000","215412353412547025196509663532932782715","335174381897296512391143356609878691466","290996714066872469541389277716815248935","333508862785924981954910392220880037432","277647464754561137415646796304470856322"]},"id":"CVE-2025-25017-19dbbb3d","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"212016229126902652735871046863928871995","length":508},"id":"CVE-2025-25017-243d03ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0b7fe68d2e369469ff9e9f344ab6df64ab9c5293","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionUpperBound.java","function":"fromString"}},{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"function":"indexMapping","file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java"},"deprecated":false,"digest":{"function_hash":"282459297521231248024296681023376889457","length":1043},"id":"CVE-2025-25017-28ff1259","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["262236121079915436119142065679252180905","137777506514668796492329693710738707556","57564652145248143655886175705483546543","114140632291519758601195886058306622434","206061497615943989835368704148231563482","123974211637094905911105515844484307346","202035863791723906355035462524171464328","263579734941057405031723276015520724794"],"threshold":0.9},"id":"CVE-2025-25017-4975358e","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"server/src/test/java/org/elasticsearch/index/mapper/vectors/DenseVectorFieldMapperTests.java"}},{"digest":{"function_hash":"90354206690606672738628107256158742437","length":1389},"id":"CVE-2025-25017-4a97e218","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c6d8fb31b39450a223671e79141dd1c4b2759b5f","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionReferencesPlugin.java","function":"apply"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"151581543923528670693525823811555113136","length":1017},"id":"CVE-2025-25017-5412173f","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"function":"createEmbeddingsField","file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java"}},{"id":"CVE-2025-25017-5ad383b0","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextDenseVectorRaisesError"},"deprecated":false,"digest":{"function_hash":"255075628869125026499779058897594092053","length":474}},{"source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java"},"deprecated":false,"digest":{"line_hashes":["158605217801375928217441734668045540378","272643381640331013499760342031064134020","53985671753460806937762457046134928512","197421975884843474782424751932224498632","147776267001273472201702975582528497363","655409951843218362925480034532671518","17637815016842550146136423455960159478","74236008148083372658918307439668483975","322466091450047313375256476185595762444","19774709324117963877378806154921988126","111332465234007377841077556799200761214","318852455395922762541962253784569936542","103714126231198070777385075505723872779","225055423574406139145017039407710500808","176602979872018362860366352636239272391","331685485893499033920803751727008752008","69845433180568037910725362514896432747","288232291348711926876643238346416986777","68055421170270233796912105902769502524","94739273273727563438676562800551104982","84737812370821697998231739337299621986","115294157346707483202906366071384113569","57212282134168748289652182660041201662","254952007036070415382532317368308133681","263203763916969629460590396437502289108","22319423814347326997056951711072005097","23504183291184894397124342894633566955","218290195268039007322983453577677478937","104397057306458966946420455493521049587","108549254030958920501876829102082088797","103602840545713796434731913178477290736","288232291348711926876643238346416986777","304973740810181194951592487929339496300","130999337670170096176664372274476384929","35867540676817589760895459391085052904","207502979453752030282883390595778036424","201606209583253241599127378006426619079","196859472990790294633289504047629811096","217941806944909312076984301808225946554","262692938943554161674911701383004754029","122608929037810719115677381049195131198","266704451184192508078195140547635007709","42779409025487380885093343877669921094","113544207510783995041866812883656149640","300270315494799500913741421782448457144","186309500865517495853234544968794613882","275404729970474416383790431094378410325","52682000639465385863593790108573768318","108301057757930837241470507337700244957","8869584976956833588688363116094065733","320322203024487798382973062775163554140"],"threshold":0.9},"id":"CVE-2025-25017-64cf6848","signature_type":"Line","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0b7fe68d2e369469ff9e9f344ab6df64ab9c5293","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionDefinition.java"},"deprecated":false,"digest":{"line_hashes":["217672349542836363100054717812710106049","252309572775993669670143339736835705616","54091541884137430139822069878767980282","107514442387382727071238824310025206689","111005771544418714502627678567496956740"],"threshold":0.9},"id":"CVE-2025-25017-6503cb05","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"304099916769792469380869096030645339333","length":65},"id":"CVE-2025-25017-69fd1bb4","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"boostNotAllowedIndexVersion"}},{"id":"CVE-2025-25017-76e75111","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/main/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapper.java","function":"parseSemanticTextField"},"deprecated":false,"digest":{"function_hash":"185620469528429678572919397230684044211","length":494}},{"deprecated":false,"digest":{"function_hash":"331323253558194736856864026167107843654","length":126},"id":"CVE-2025-25017-77569fab","signature_type":"Function","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"testOldIndexSemanticTextMinimalMappingRaisesError"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0b7fe68d2e369469ff9e9f344ab6df64ab9c5293","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionUpperBound.java"},"deprecated":false,"digest":{"line_hashes":["139962615708899532931476526299928016888","126012236464058294405097823268518027751","289303983905263332908242656297363008578","106190180500815641575834140526701597639"],"threshold":0.9},"id":"CVE-2025-25017-7fcef6d9"},{"digest":{"line_hashes":["17047697132091523167696546037502393114","186998624783687865062194776846591917407","313925496811474694517599806095265053507","43591908161988811249636983155384315144","51362330270681278222633334666757188965","6434747799091991094916765659969833820","257596224557044121426596031748525730356","34971271636189503506429037745419631991","7886278914795505251423687570192034958","174686354109383981922384148706055248694","31761369374311658025302373061685049890","31328752844814563230649231401000983729"],"threshold":0.9},"id":"CVE-2025-25017-8cb88803","signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c6d8fb31b39450a223671e79141dd1c4b2759b5f","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionResourcesPlugin.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c6d8fb31b39450a223671e79141dd1c4b2759b5f","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionReferencesPlugin.java"},"deprecated":false,"digest":{"line_hashes":["180551254947792262872544340034400293557","264027860764397316031573051019266933081","44151976838782051178779290326798000534","73731157910129633539158313046062642474","204442736025042855938210968475903219240","141958569979963664316519408297393523341","252038306184163585631326145345940508203","217660552227507015573164445141036982368","193224483228772424298542276983865386285"],"threshold":0.9},"id":"CVE-2025-25017-b0085fac"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/c1310008a98b8bb63c9fc08e763de1d065b943ce","target":{"file":"x-pack/plugin/inference/src/test/java/org/elasticsearch/xpack/inference/mapper/SemanticTextFieldMapperTests.java","function":"assertOldIndexUnsupported"},"deprecated":false,"digest":{"function_hash":"192095868591587962532804350088891814436","length":331},"id":"CVE-2025-25017-bac55aa9","signature_type":"Function"},{"source":"https://github.com/elastic/elasticsearch/commit/c6d8fb31b39450a223671e79141dd1c4b2759b5f","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionResourcesPlugin.java","function":"apply"},"deprecated":false,"digest":{"function_hash":"314578485495703872768095023722097166579","length":3053},"id":"CVE-2025-25017-d8162ddd","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/elastic/elasticsearch/commit/0b7fe68d2e369469ff9e9f344ab6df64ab9c5293","target":{"file":"build-tools-internal/src/main/java/org/elasticsearch/gradle/internal/transport/TransportVersionDefinition.java","function":"fromString"},"deprecated":false,"digest":{"function_hash":"338183758137292559670795857535155821477","length":537},"id":"CVE-2025-25017-ff0f556b","signature_type":"Function"}]}},{"ranges":[{"type":"GIT","repo":"https://github.com/elastic/kibana","events":[{"introduced":"ee89fda8a17eff9c93f7400c102edf76cb4d7d8a"},{"fixed":"08ece643671f3ee61a7297b3e67aa99e79a1aef7"},{"introduced":"ffd7cbf34ac1234c78354f2a22ef5f1703c04eaf"},{"fixed":"57608cbf53423b24acae7c1e589faf57a6bacaf2"},{"introduced":"504d6bfa94cca17fabb76e06152c30c4f0c3efdd"},{"fixed":"9d44cc2d50d27f4d3ae7b72f0fe6b612508674bb"},{"introduced":"9f30374092edd41719399f7ef81cb7ae78d8a3ab"},{"fixed":"a8042692500503cca8f3d4aed3c38da398c22f9d"}],"database_specific":{"cpe":"cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"7.0.0"},{"fixed":"8.18.8"},{"introduced":"8.19.0"},{"fixed":"8.19.4"},{"introduced":"9.0.0"},{"fixed":"9.0.7"},{"introduced":"9.1.0"},{"fixed":"9.1.4"}],"source":"CPE_RANGE"}}],"versions":["v9.1.2","v8.19.3","v9.0.6","v9.1.3","v8.19.2","v9.0.5","v8.19.1","v9.1.1","v9.1.0","v8.19.0","v9.0.4","v9.0.3","v9.0.2","v9.0.1","v9.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25017.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N"}]}