Skip to content
CVE PROGRAM SOURCE RECORD6.1 Medium

CVE-2025-68387

Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
elastic

Description

Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Elastic Kibana

Default version status: unaffected

  • 7.0.0 to ≤ 7.17.29affected
  • 8.0.0 to ≤ 8.19.8affected
  • 9.0.0 to ≤ 9.1.8affected
  • 9.2.0 to ≤ 9.2.2affected

References