CVE-2025-68387 Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
An unauthenticated attacker can inject malicious scripts via the Vega AST evaluator, leading to cross-site scripting attacks against Kibana users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-68387?
CVE-2025-68387 is a medium-severity cross-site scripting vulnerability in Elastic Kibana, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
Weakness: CWE-79
Which versions are affected by CVE-2025-68387?
2 open source packages ship an affected version, including kibana and elk. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kibana Bitnami | All versions | 8.19.9, 9.1.9, 9.2.3 |
elk Bitnami | All versions | 8.19.9, 9.1.9, 9.2.3 |
Products include Elastic Kibana.
How do I fix CVE-2025-68387?
Upgrade kibana to a fixed version for your release line: 8.19.9, 9.1.9 or 9.2.3.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-68387 being exploited?
There is no known exploitation of CVE-2025-68387 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as BIT-elk-2025-68387, BIT-kibana-2025-68387, GHSA-4rxh-p69j-7rxg, MINI-3h8f-pmhr-83m7, MINI-4j5p-gp7g-x4h5, MINI-f7r4-66xq-97c4 and 3 more.