{"id":"CVE-2019-7609","published":"2019-03-25T19:29:02Z","modified":"2026-06-17T02:40:45Z","title":"Kibana Arbitrary Code Execution","vendor":"Elastic","product":"Kibana","tier":"core","eol":null,"description":{"text":"Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.","provenance":"source","from":"NVD"},"summary":{"text":"The Timelion visualizer in Elastic's Kibana, in versions before 5.6.15 and 6.6.1, contains an arbitrary code execution flaw caused by improper control of code generation. An attacker with access to the Timelion application could send a request that attempts to execute JavaScript, potentially running arbitrary commands with the permissions of the Kibana process on the host system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T08:31:40Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.95338,"percentile":0.99866,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2022-01-10","dueDate":"2022-07-10","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-7609","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-05-07","exploitedFirstSeen":"2021-05-07","ransomware":false,"evidence":[{"url":"https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf","date":"2021-05-07"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-01-10"},{"url":"https://cisa.gov/news-events/alerts/2022/01/11/understanding-and-mitigating-russian-state-sponsored-cyber-threats-us","date":"2022-03-01"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa22-011a","date":"2022-03-01"},{"url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-011a","date":"2022-03-01"},{"url":"https://1665891.fs1.hubspotusercontent-na1.net/hubfs/1665891/Threat%20reports/AquaSecurity_Kinsing_Demystified_Technical_Guide.pdf","date":"2024-05-10"},{"url":"https://www.cisa.gov/sites/default/files/2024-07/aa24-207a-dprk-cyber-group-conducts-global-espionage-campaign.pdf","date":"2024-07-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-19&host_type=src&vulnerability=cve-2019-7609","date":"2026-09-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-20&host_type=src&vulnerability=cve-2019-7609","date":"2026-09-20"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-21&host_type=src&vulnerability=cve-2019-7609","date":"2026-09-21"}],"evidenceTotal":29,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHBA-2019:2824","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2860","tags":["Third Party Advisory"]},{"url":"https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077","tags":["Vendor Advisory"]},{"url":"https://www.elastic.co/community/security","tags":["Broken Link","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHBA-2019:2824","tags":["Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2860","tags":["Third Party Advisory"]},{"url":"https://discuss.elastic.co/t/elastic-stack-6-6-1-and-5-6-15-security-update/169077","tags":["Vendor Advisory"]},{"url":"https://www.elastic.co/community/security","tags":["Broken Link","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7609","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker sends crafted request to public-facing web application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"An attacker with access to the Timelion application could send a request","start":109,"end":181}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Arbitrary JavaScript execution on the server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"attempt to execute javascript code","start":192,"end":226}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-8b6e5f3c2592261e3f88","title":"Advisory further TTPs associated with SVR cyber actors","publisher":"ncsc.gov.uk","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf","date":null,"mentions":[{"quote":"• CVE-2019-7609 Kibana","start":2771,"end":2793}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-17147","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-17147","exploited":true,"exploitedSince":"2022-01-10","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":12,"skipped":1,"earliest":"2019-10-18","earliestUrl":"https://github.com/jas502n/kibana-RCE","repos":[{"name":"LandGrey/CVE-2019-7609","url":"https://github.com/LandGrey/CVE-2019-7609","stars":165,"created":"2019-10-21"},{"name":"jas502n/kibana-RCE","url":"https://github.com/jas502n/kibana-RCE","stars":89,"created":"2019-10-18"},{"name":"mpgn/CVE-2019-7609","url":"https://github.com/mpgn/CVE-2019-7609","stars":58,"created":"2019-10-21"},{"name":"hekadan/CVE-2019-7609","url":"https://github.com/hekadan/CVE-2019-7609","stars":20,"created":"2019-12-01"},{"name":"Cr4ckC4t/cve-2019-7609","url":"https://github.com/Cr4ckC4t/cve-2019-7609","stars":4,"created":"2022-03-17"}]},"metasploit":[{"name":"Kibana Timelion Prototype Pollution RCE","module":"exploit/linux/http/kibana_timelion_prototype_pollution_rce","type":"exploit","disclosureDate":"2019-10-30","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/kibana_timelion_prototype_pollution_rce.rb"}],"nuclei":[{"id":"CVE-2019-7609","name":"Kibana Timelion - Arbitrary Code Execution","severity":"critical","path":"http/cves/2019/CVE-2019-7609.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2019/CVE-2019-7609.yaml"}],"first":{"date":"2019-10-18","source":"PoC-in-GitHub","url":"https://github.com/jas502n/kibana-RCE"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/174569/Kibana-Timelion-Prototype-Pollution-Remote-Code-Execution.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2019-03-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7609","provenance":"source"},{"date":"2019-10-18","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2019-10-30","url":"https://github.com/jas502n/kibana-RCE","provenance":"source"},{"date":"2021-05-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ncsc.gov.uk/files/Advisory%20Further%20TTPs%20associated%20with%20SVR%20cyber%20actors.pdf","provenance":"source"},{"date":"2022-01-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-01-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-17147","provenance":"source"}],"speed":{"daysToPublicExploit":207,"firstExploitFrom":"PoC-in-GitHub","daysToKev":1022},"priority":{"score":73.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2003 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9987"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-elastic-kibana-cwe-94"}}