CVE-2025-25014

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-25014
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25014.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-25014
Aliases
Published
2025-05-06T17:30:45Z
Modified
2026-08-12T14:52:32Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Kibana arbitrary code execution via prototype pollution
Details

A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints.

Database specific 
{
    "cna_assigner": "elastic",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/25xxx/CVE-2025-25014.json"
}
References

Affected packages

Git / github.com/elastic/elasticsearch

Affected ranges

Type
GIT
Repo
https://github.com/elastic/elasticsearch
Events
Introduced
5b8b981647acdf1ba1d88751646b49d1b461b4cc
Fixed
dbcbbbd0bc4924cfeb28929dc05d82d662c527b7
Introduced
04e979aa50b657bebd4a0937389308de82c2bdad
Last Affected
112859b85d50de2a7e63f73c8fc70b99eea24291
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:elastic:kibana:8.18.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:elastic:kibana:9.0.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.17.6"
        },
        {
            "introduced": "8.18.0"
        },
        {
            "last_affected": "8.18.0"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}
Type
GIT
Repo
https://github.com/elastic/kibana
Events
Introduced
8a54c809495bc08782359073d9392f25c8eb6499
Fixed
28847d93343b5a3adfb1bcb953866a6705ab746f
Introduced
c220d2938cd718bb332afb07baaf95999eb28759
Last Affected
504d6bfa94cca17fabb76e06152c30c4f0c3efdd
Database specific
Show details 
{
    "cpe": [
        "cpe:2.3:a:elastic:kibana:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:elastic:kibana:8.18.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:elastic:kibana:9.0.0:-:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "8.3.0"
        },
        {
            "fixed": "8.17.6"
        },
        {
            "introduced": "8.18.0"
        },
        {
            "last_affected": "8.18.0"
        },
        {
            "introduced": "9.0.0-NA"
        },
        {
            "last_affected": "9.0.0-NA"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

8.*
8.18.0
9.*
9.0.0-NA

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-25014.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "function_hash": "155988868032570604689205509621145303938",
            "length": 826
        },
        "id": "CVE-2025-25014-2056b06f",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7",
        "target": {
            "file": "x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java",
            "function": "guessMappingsAndCalculateFieldStats"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "103062777601327816001532191706242182431",
                "211766124421928476690457691246930073396",
                "109357362993875544563704018619993770016"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-25014-2d075337",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7",
        "target": {
            "file": "x-pack/plugin/text-structure/src/test/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtilsTests.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "106213297097279866768185910228201675810",
                "314168248095395219328740139850914297886",
                "119162934123016417405811605557729668362",
                "39859272969510159055531249577201918212",
                "244933187160039656490785231674378323577",
                "234077450779033024857046981396487847380",
                "93436833372906784425240664014202993134",
                "202381044633269865317511751622544903898",
                "254831802349912243738659411130675016589",
                "120183324559202470104653390017387002778",
                "180925524410113248638112654699035780330",
                "102344227782104906477873574944152304516"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-25014-6f51145d",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7",
        "target": {
            "file": "x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "66582372798516181147542140247763769422",
            "length": 1112
        },
        "id": "CVE-2025-25014-cf8bab70",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/elastic/elasticsearch/commit/dbcbbbd0bc4924cfeb28929dc05d82d662c527b7",
        "target": {
            "file": "x-pack/plugin/text-structure/src/main/java/org/elasticsearch/xpack/textstructure/structurefinder/TextStructureUtils.java",
            "function": "guessMappingAndCalculateFieldStats"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T14:52:32Z"