Critical Elastic Cloud Flaw: CVE-2025-37729 (CVSS 9.1) Allows RCE via Jinjava Template Injection

Elastic has issued urgent updates for Elastic Cloud Enterprise (ECE) to patch a critical vulnerability, CVE-2025-37729, which has a CVSS score of 9.1 and could allow an attacker with administrative access to exfiltrate data or execute arbitrary commands through Jinjava template injection.

According to Elastic, improper neutralisation of special elements in a template engine can let a malicious actor with Admin access exfiltrate sensitive information and issue commands via a specially crafted string where Jinjava variables are evaluated. The flaw stems from insufficient input sanitization in the Jinjava template engine used within ECE’s configuration templates, enabling payloads to be interpreted as executable expressions.

Elastic states that versions 2.5.0 up to 3.8.1 and 4.0.0 up to 4.0.1 are affected, with patched releases 3.8.2 and 4.0.2 available to harden variable evaluation and neutralise unsafe constructs. The company also recommends monitoring request logs for malicious payloads and reviewing admin access controls, since exploitation requires administrative-level access.