Introduction
Attackers can use a single malicious dashboard to compromise user sessions and gain unauthorized access to sensitive data in Kibana deployments. CVE-2025-25017, a recently discovered critical cross-site scripting (XSS) flaw in the Vega visualization engine, affects a wide range of Kibana versions and puts organizations that leave it unpatched at significant risk.
About Kibana and Elastic: Kibana is the visualization and dashboard component of the Elastic Stack, which also includes Elasticsearch, Logstash, and Beats. Elastic is a major vendor in observability and analytics, and thousands of enterprises use its products for log management, security analytics, and business intelligence. Kibana's Vega integration supports advanced, flexible visualizations and is popular with technical teams worldwide.
Technical Information
CVE-2025-25017 is a vulnerability in Kibana's Vega visualization engine caused by improper neutralization of user-supplied input during web page generation. Vega specifications are JSON documents that define how data is visualized, including data sources, transformations, and interactive behaviors. In affected versions of Kibana (7.0.0 through 9.1.3), certain fields in the Vega spec were not properly sanitized before the browser rendered them. An attacker with permission to create or modify Vega visualizations could inject malicious JavaScript directly into the visualization definition.
When a victim views a dashboard or visualization that contains the malicious Vega spec, the injected script runs in the context of their browser session. That opens the door to session hijacking, credential theft, and unauthorized actions performed through the Kibana API. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). Attack complexity is low. The attack needs only a victim to view a crafted visualization. No public proof of concept has been released as of this writing.
Patch Information
Kibana 8.18.8, 8.19.5, 9.0.8, and 9.1.5 fix the following issues:
-
Cross-Site Scripting (XSS) in Vega Visualizations: Input in Vega visualizations was not properly neutralized during web page generation, which could lead to XSS attacks. The patch sanitizes all user input before rendering, so malicious scripts cannot run in the Kibana interface. (discuss.elastic.co)
-
Stored Cross-Site Scripting (XSS) via Case File Upload: Malicious scripts could be stored through case file uploads and would run when someone viewed the case. The fix adds stronger validation and sanitization of file contents on upload, so embedded scripts are neutralized and cannot run. (discuss.elastic.co)
-
Stored Cross-Site Scripting (XSS) in Fleet and Integrations: A flaw in how the Fleet and Integrations modules validated input types could lead to stored XSS attacks. The update adds stricter input validation, so Kibana processes only expected data types and rejects potentially harmful input. (discuss.elastic.co)
-
Insufficiently Protected Credentials in the CrowdStrike Connector: Cached credentials from the Elastic CrowdStrike connector were exposed, which allowed unauthorized access across different spaces. The patch strengthens credential storage and access controls, so credentials stay compartmentalized and accessible only within their intended scope. (discuss.elastic.co)
Upgrade to a patched version as soon as you can. If you cannot upgrade right away, disabling the affected features, such as Vega visualizations, works as a temporary mitigation. Upgrading is still the most effective way to secure your Kibana deployment.
Affected Systems and Versions
CVE-2025-25017 affects the following Kibana versions:
- 7.x: All versions from 7.0.0 up to and including 7.17.29
- 8.x: All versions from 8.0.0 up to and including 8.18.7
- 8.19.x: All versions from 8.19.0 up to and including 8.19.3
- 9.0.x: All versions from 9.0.0 up to and including 9.0.6
- 9.1.x: All versions from 9.1.0 up to and including 9.1.3
All configurations with Vega visualizations enabled are vulnerable.
Vendor Security History
Elastic has fixed multiple XSS vulnerabilities in Kibana and related Elastic Stack components before. Elastic publishes detailed, timely security advisories and runs a responsible disclosure program. It has historically patched critical issues promptly and released the fixes across all supported version lines.
