{"id":"CVE-2019-7609","aliases":["EUVD-2019-17147","GHSA-cp8f-5jp9-rqmh","RHSA-2019:2860"],"status":"published","title":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion...","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.95338,"percentile":0.99867,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-94"],"published":"2019-03-25T00:00:00Z","modified":"2026-10-24T10:30:59Z","kev":{"date_added":"2022-01-10","due_date":"2022-07-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2022-01-10"},{"source":"kev","since":"2022-01-10"}],"exploits":[{"source":"pocgithub","id":"jas502n/kibana-RCE","title":"jas502n/kibana-RCE","date":"2019-10-18","url":"https://github.com/jas502n/kibana-RCE"},{"source":"pocgithub","id":"LandGrey/CVE-2019-7609","title":"LandGrey/CVE-2019-7609","date":"2019-10-21","url":"https://github.com/LandGrey/CVE-2019-7609"},{"source":"pocgithub","id":"mpgn/CVE-2019-7609","title":"mpgn/CVE-2019-7609","date":"2019-10-21","url":"https://github.com/mpgn/CVE-2019-7609"},{"source":"metasploit","id":"exploit/linux/http/kibana_timelion_prototype_pollution_rce","title":"Kibana Timelion Prototype Pollution RCE","type":"exploit","platform":"Unix","date":"2019-10-30","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/kibana_timelion_prototype_pollution_rce"},{"source":"pocgithub","id":"hekadan/CVE-2019-7609","title":"hekadan/CVE-2019-7609","date":"2019-12-01","url":"https://github.com/hekadan/CVE-2019-7609"},{"source":"pocgithub","id":"rhbb/CVE-2019-7609","title":"rhbb/CVE-2019-7609","date":"2020-04-03","url":"https://github.com/rhbb/CVE-2019-7609"},{"source":"pocgithub","id":"dnr6419/CVE-2019-7609","title":"dnr6419/CVE-2019-7609","date":"2021-08-24","url":"https://github.com/dnr6419/CVE-2019-7609"},{"source":"pocgithub","id":"wolf1892/CVE-2019-7609","title":"wolf1892/CVE-2019-7609","date":"2022-02-10","url":"https://github.com/wolf1892/CVE-2019-7609"},{"source":"pocgithub","id":"Cr4ckC4t/cve-2019-7609","title":"Cr4ckC4t/cve-2019-7609","date":"2022-03-17","url":"https://github.com/Cr4ckC4t/cve-2019-7609"},{"source":"pocgithub","id":"d0x-awrqxavc/CVE-2019-7609-KibanaRCE","title":"d0x-awrqxavc/CVE-2019-7609-KibanaRCE","date":"2023-07-17","url":"https://github.com/d0x-awrqxavc/CVE-2019-7609-KibanaRCE"},{"source":"pocgithub","id":"Akshay15-png/CVE-2019-7609","title":"Akshay15-png/CVE-2019-7609","date":"2024-06-01","url":"https://github.com/Akshay15-png/CVE-2019-7609"},{"source":"pocgithub","id":"aleister1102/kibana-prototype-pollusion","title":"aleister1102/kibana-prototype-pollusion","date":"2024-06-23","url":"https://github.com/aleister1102/kibana-prototype-pollusion"},{"source":"pocgithub","id":"toxxxaka/CVE-2019-7609","title":"toxxxaka/CVE-2019-7609","date":"2026-02-17","url":"https://github.com/toxxxaka/CVE-2019-7609"},{"source":"pocgithub","id":"CyberCTF/vulhub-kibana-cve-2019-7609","title":"CyberCTF/vulhub-kibana-cve-2019-7609","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-kibana-cve-2019-7609"},{"source":"nuclei","id":"CVE-2019-7609","title":"Kibana Timelion - Arbitrary Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7609.yaml"}],"affected":[{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"kibana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.16-2.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el7","package":"kibana-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.6.16-2.el7"}]}],"bundled":3}],"products":[{"vendor":"elastic","product":"kibana"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077","tags":["x_transferred","Vendor Advisory","advisory","article"]},{"url":"https://www.elastic.co/community/security","tags":["x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2860","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://access.redhat.com/errata/RHBA-2019:2824","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7609","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cp8f-5jp9-rqmh"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696030","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1696032","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2860.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7608","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7608","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7608","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7609","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7609","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-7610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-7610","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7610","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-7609","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","status":"published","published":"2019-03-25T00:00:00Z","modified":"2025-10-21T23:45:41.577Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2019-17147","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","status":"published","published":"2019-03-25T00:00:00Z","modified":"2025-10-21T23:45:41Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2022-01-10","updated_at":"2026-11-02T20:31:24.172282Z"}],"ghsa":[{"id":"GHSA-cp8f-5jp9-rqmh","title":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion...","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","status":"published","published":"2022-05-13T01:14:26Z","modified":"2025-10-22T00:32:42Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T15:04:06.493434Z"}],"kev":[{"id":"CVE-2019-7609","title":"Kibana Arbitrary Code Execution","description":"Kibana contain an arbitrary code execution flaw in the Timelion visualizer.","cwes":["CWE-94"],"kev":{"date_added":"2022-01-10","due_date":"2022-07-10","required_action":"Apply updates per vendor instructions.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.541131Z"}],"nvd":[{"id":"CVE-2019-7609","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","status":"published","published":"2019-03-25T19:29:02.147Z","modified":"2026-06-17T02:40:45.257Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-94"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-7609","description":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","status":"published","published":"2019-03-25T19:29:02.147Z","modified":"2026-10-24T10:30:59.31747496Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:12.675558Z"},{"id":"RHSA-2019:2860","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.18 security update","status":"published","published":"2024-09-16T02:56:45Z","modified":"2026-06-27T10:08:08Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}