Improper Output Neutralization for Logs (CWE-117) in Kibana allows an attacker to supply crafted input that is written to log files without escaping terminal control sequences. When those logs are viewed in a terminal that interprets escape codes, the injected content may alter the displayed log data. The vulnerability can be leveraged to hide original log entries or insert fraudulent ones, compromising the integrity of audit trails.

Elastic Kibana is the affected product. The CVE does not specify versions, so all unpatched instances that write user‑supplied data to logs are vulnerable.

The CVSS score of 8.0 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates that exploitation is currently unlikely, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to inject terminal control sequences via any interface that logs user input. Once injected, viewing the resulting log entries in a terminal that renders escape codes can reveal tampered output, undermining trust in security monitoring and enabling concealment of malicious activity.