CVE-2025-37729 Elastic Cloud Enterprise (ECE) Improper Neutralization of Special Elements Used in a Template Engine
Admins can execute code and exfiltrate data via template injection in Elastic Cloud Enterprise, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-37729?
CVE-2025-37729 is a critical code injection vulnerability in Elastic Cloud Enterprise (ECE), published on 13 Oct 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
Weakness: CWE-1336
Which versions are affected by CVE-2025-37729?
It affects 1 product.
Products include Elastic Elastic Cloud Enterprise.
How do I fix CVE-2025-37729?
No fix has been published for CVE-2025-37729 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-37729 being exploited?
There is no known exploitation of CVE-2025-37729 in the wild and no public exploit code.
Other vulnerabilities in Elastic Cloud Enterprise (ECE)
- CVE-2025-37736 Elastic Cloud Enterprise Improper Authorization
- CVE-2024-37282 Privilege escalation in Elastic Cloud Enterprise
- CVE-2023-31418 Elasticsearch uncontrolled resource consumption
- CVE-2018-3828 Information disclosure in Elastic Cloud Enterprise
- CVE-2022-23715 Information disclosure in Elastic Cloud Enterprise
Sources
Also known as GHSA-9w6c-7rw2-2w66.