CVE-2025-37729

critical · 9.1

Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.

9.1

CVSS

0.7%

EPSS (exploit prob.)

50th

EPSS percentile

2025-10-13

Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-1336

Affected products

Vendor	Product	Affected versions
elastic	elastic_cloud_enterprise	>= 2.5.0, < 3.8.2
elastic	elastic_cloud_enterprise	>= 4.0.0, < 4.0.2

Check a specific version with /api/v1/cve/match.

References

https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-3-8-2-and-4-0-2-security-update-esa-2025-21/382641

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-37729