It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Elastic Kibana | — | Upgrade Elastic Kibana to the latest version | Sep 3, 2025 | Nov 22, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub