Visualizations Weaponized: New Kibana Flaw Allows XSS Attacks via Vega Charts

Elastic has issued important security updates for Kibana after discovering a high-severity vulnerability that allows attackers to turn charts and graphs into weapons. Tracked as CVE-2025-68385, the flaw carries a CVSS score of 7.2 and enables authenticated users to execute XSS attacks by exploiting a gap in the Vega visualization tool.

Kibana allows users to create custom visualisations using Vega, a declarative language for creating interactive designs, which can be exploited when a dashboard is viewed by another user with higher privileges.

According to the disclosure, the issue stems from “Improper neutralization of input during web page generation.” The blast radius covers nearly all recent major versions, with 7.x affected, 8.x vulnerable from 8.0.0 up to 8.19.8, and 9.x vulnerable from 9.0.0 up to 9.1.8, and 9.2.0 up to 9.2.2; patches are v8.19.9, v9.1.9, and v9.2.3, with administrators urged to upgrade accordingly.