CVE-2025-25017: 
Kibana vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability has been identified in Kibana's Vega visualization engine, tracked as CVE-2025-25017. The vulnerability stems from improper neutralization of input during web page generation in Vega visualizations. This security flaw affects all Kibana configurations across versions 7.x (up to 7.17.29), 8.x (up to 8.18.7), 8.19.x (up to 8.19.3), 9.0.x (up to 9.0.6), and 9.1.x (up to 9.1.3). The vulnerability was disclosed on October 10, 2025, and received a CVSS v3.1 score of 8.2 (High) (Elastic Discussion, Security Online).

The vulnerability (CVE-2025-25017) is classified as an Improper Neutralization of Input During Web Page Generation vulnerability (CWE-79). The issue specifically affects the Vega visualization engine within Kibana, where unvalidated inputs within Vega visualization specifications can allow attackers to inject malicious JavaScript. The vulnerability has been assigned a CVSS v3.1 Base Score of 8.2 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (Security Online).

If successfully exploited, this XSS vulnerability could allow attackers to execute arbitrary scripts within the Kibana interface. The impact includes potential data theft, session hijacking, and privilege escalation within Kibana dashboards. The CVSS scoring indicates high impact on integrity and some impact on confidentiality, though availability is not affected (Security Online).

Elastic has released patches in versions 8.18.8, 8.19.5, 9.0.8, and 9.1.5 to address this vulnerability. For users unable to upgrade immediately, a workaround is available by disabling Vega visualizations entirely. This can be accomplished by setting vis_type_vega.enabled: false in the kibana.yml file for on-premise installations. Elastic Cloud customers can contact support to have the feature disabled at the deployment level (Elastic Discussion, Security Online).