CVE-2021-22150: Elastic Kibana

High severity, CVSS 7.2. EPSS: 1.2% chance of exploitation in the next 30 days.

It was discovered that a user with Fleet admin permissions could upload a malicious package. Due to using an older version of the js-yaml library, this package would be loaded in an insecure manner, allowing an attacker to execute commands on the Kibana server.

Affected products

• Elastic Kibana: from 7.10.2, before 7.14.1 (fixed in 7.14.1)

Published 2023-11-22. Last modified 2026-06-17.