WARNING: ARBITRARY CODE EXECUTION IN KIBANA, PATCH IMMEDIATELY!

A critical security vulnerability, CVE-2025-25012, has been identified in Kibana versions 8.15.0 through 8.17.2. This flaw arises from prototype pollution, a type of vulnerability that allows attackers to manipulate JavaScript objects and properties, potentially leading to unauthorized actions such as arbitrary code execution.

In affected versions, an attacker can exploit this vulnerability by uploading a crafted file or sending specifically crafted HTTP requests, leading to arbitrary code execution. Notably, in versions 8.15.0 to 8.17.0, even users with the minimal ‘Viewer’ role can exploit this flaw. In versions 8.17.1 and 8.17.2, exploitation requires roles with combined privileges: fleet-all, integrations-all, and actions:execute-advanced-connectors.