Improper neutralization of input during web page generation in Kibana allows a user with write rights to an Elasticsearch index to store malicious markup. The stored markup is rendered without sufficient sanitization when another user views a Kibana object, enabling injected HTML to manipulate the user interface and trigger network requests from the victim's browser. This vulnerability falls under CWE-79 and could be leveraged by attackers with write access to devise phishing or data exfiltration tactics.

The flaw affects Elastic Kibana. No specific version numbers are listed in the CNA data, but the vendor reference indicates that updates such as 8.19.16 and 9.3.5 contain the fix. All installations of Kibana that expose writeable indices to users who could craft content are considered at risk.

The CVSS score of 4.1 signals a moderate severity, and the EPSS score is not available, suggesting no publicly known exploit prevalence. The vulnerability is not listed in the CISA KEV catalog. Likely exploitation requires an attacker to obtain write access to an index and persist malicious HTML, then wait for an unprivileged user to view the affected Kibana view. Inference about the exact attack vector is based on the description of write access to a database and subsequent rendering by another user.