CVE-2025-68385: Elastic Kibana XSS Vulnerability

CVE-2025-68385 Overview

CVE-2025-68385 is a stored cross-site scripting (XSS) vulnerability in Elastic Kibana. The flaw resides in the Vega visualization integration and bypasses a previously implemented Vega XSS mitigation. An authenticated user can embed a malicious script inside Vega-generated content, which then executes in the browser of any user viewing the affected visualization.

The vulnerability is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and mapped to [CAPEC-63]. Elastic addressed the issue in Kibana 8.19.9, 9.1.9, and 9.2.3 as part of security advisory ESA-2025-34.

Critical Impact
An authenticated attacker can inject scripts through Vega visualizations that execute in the browser context of other Kibana users, enabling session theft, credential harvesting, and unauthorized actions within Kibana.

Affected Products

Elastic Kibana versions prior to 8.19.9
Elastic Kibana 9.x versions prior to 9.1.9
Elastic Kibana 9.2.x versions prior to 9.2.3

Discovery Timeline

2025-12-18 - CVE-2025-68385 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-68385

Vulnerability Analysis

Kibana embeds Vega, a declarative language for building visualizations. Vega specifications support expressions and URL handlers that, if not strictly sanitized, can execute arbitrary JavaScript in the Kibana web application context. Elastic previously introduced a mitigation to block XSS via Vega, but CVE-2025-68385 identifies a method that circumvents that guardrail.

An authenticated user with permission to create or edit Vega visualizations can craft a specification that produces attacker-controlled markup or script execution when the visualization is rendered. Because Kibana dashboards are typically shared across teams, the injected payload is delivered to any user viewing the dashboard.

The attack requires user interaction (UI:R) to trigger the payload and changes the security scope beyond the vulnerable component (S:C), reflecting cross-context impact on the browser session.

Root Cause

The root cause is incomplete input neutralization in the Vega rendering path within Kibana. A specific Vega method or expression construct was not covered by the earlier sanitization logic, allowing script content to survive filtering and be executed in the DOM when the visualization loads.

Attack Vector

An authenticated attacker with visualization authoring rights saves a Vega spec containing a bypass payload. The payload persists in Kibana saved objects. When another user opens the dashboard or visualization, their browser executes the injected script under the Kibana origin. The attacker can hijack the victim's session, exfiltrate data visible in Kibana, or perform actions using the victim's privileges, including higher-privileged administrative operations.

No verified public proof-of-concept code is available. Refer to the Elastic Security Update ESA-2025-34 for vendor technical details.

Detection Methods for CVE-2025-68385

Indicators of Compromise

Vega visualization saved objects containing unusual signal, expr, or URL handler fields referencing javascript: schemes or encoded script payloads.
Unexpected outbound HTTP requests from user browsers to attacker-controlled domains initiated from Kibana dashboard sessions.
Kibana audit log entries showing visualization create or update events by non-administrative accounts followed by wide dashboard access.

Detection Strategies

Audit Kibana saved objects of type visualization where the spec contains Vega code and review recently modified entries for suspicious script constructs.
Enable and review Kibana audit logging for saved_object_create and saved_object_update events targeting Vega visualizations.
Deploy Content Security Policy (CSP) reporting to capture blocked inline script attempts originating from Kibana pages.

Monitoring Recommendations

Correlate Kibana access logs with anomalous session activity such as new API keys, role changes, or exports occurring shortly after dashboard views.
Monitor browser DOM telemetry from managed endpoints for script injection patterns tied to the Kibana origin.
Alert on Kibana version fingerprints returned by internal scanners to identify hosts still running unpatched builds.

How to Mitigate CVE-2025-68385

Immediate Actions Required

Upgrade Kibana to 8.19.9, 9.1.9, or 9.2.3 or later, as specified in ESA-2025-34.
Review and remove untrusted Vega visualizations created between the introduction of Vega support and the patch date.
Rotate Kibana session tokens and API keys for users who accessed dashboards containing untrusted Vega content.

Patch Information

Elastic released fixed builds 8.19.9, 9.1.9, and 9.2.3. Details are published in the Elastic Security Update ESA-2025-34. Apply the update through your standard Elastic Stack upgrade procedure and validate that the running version matches or exceeds the fixed release.

Workarounds

Restrict the Kibana privilege that permits creating or editing Vega visualizations to a small set of trusted administrators.
Disable Vega visualization support in Kibana configuration where the feature is not required by business workflows.
Enforce a strict Content Security Policy in Kibana deployments to reduce the impact of injected scripts.

bash

# Example: restrict Vega visualization role in Kibana via kibana.yml
xpack.security.authc.selector.enabled: true
# Grant the 'visualize' feature only to trusted roles in role mappings,
# and remove 'all' access to Visualize for general analyst roles.