Description
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Elastic | Kibana | before 5.6.15 and 6.6.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | kibana | 5.6.16-2.el7 | RHSA-2019:2860 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Kibana Timelion Prototype Pollution RCE
exploit/linux/http/kibana_timelion_prototype_pollution_rce
GitHub 13 repositories · most starred shown
-
LandGrey/CVE-2019-7609 ★ 165 · Oct 21, 2019
exploit CVE-2019-7609(kibana RCE) on right way by python2 scripts
-
jas502n/kibana-RCE ★ 89 · Oct 18, 2019
kibana < 6.6.0 未授权远程代码命令执行 (Need Timelion And Canvas),CVE-2019-7609
-
mpgn/CVE-2019-7609 ★ 58 · Oct 21, 2019
RCE on Kibana versions before 5.6.15 and 6.6.0 in the Timelion visualizer
-
hekadan/CVE-2019-7609 ★ 20 · Dec 1, 2019
-
Cr4ckC4t/cve-2019-7609 ★ 4 · Mar 17, 2022
Kibana <6.6.0 RCE written in python3
-
Akshay15-png/CVE-2019-7609 ★ 1 · Jun 1, 2024
Exploit for CVE-2019-7609 in python
-
dnr6419/CVE-2019-7609 ★ 1 · Aug 24, 2021
Kibana Prototype Pollution
-
rhbb/CVE-2019-7609 ★ 1 · Apr 3, 2020
-
d0x-awrqxavc/CVE-2019-7609-KibanaRCE ★ 0 · Jul 17, 2023
-
wolf1892/CVE-2019-7609 ★ 0 · Feb 10, 2022
docker lab setup for kibana-7609
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Kibana Timelion - Arbitrary Code Execution http/cves/2019/CVE-2019-7609.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- RHSA-2019:2860 Red Hat Security Advisory: OpenShift Container Platform 4.1.18 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026