Unrated severityOSV Advisory· Published Dec 18, 2025· Updated Dec 19, 2025
Kibana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-68387
Description
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a vulnerability a function handler in the Vega AST evaluator.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- osv-coords5 versionspkg:apk/chainguard/kibana-8.17-bitnamipkg:apk/chainguard/kibana-8.18-bitnamipkg:apk/chainguard/kibana-8.19-bitnamipkg:bitnami/elkpkg:bitnami/kibana
< 8.17.10-r11+ 4 more
- (no CPE)range: < 8.17.10-r11
- (no CPE)range: < 8.18.8-r10
- (no CPE)range: < 8.19.11-r0
- (no CPE)range: < 8.19.9
- (no CPE)range: < 8.19.9
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.