CVE-2025-37729
Critical · CVSS 9.1- CVSS
- 9.1
- nvd
- EPSS
- 0.66%
- 50th pct
- KEV
- No
- Class
- other
- CWE-1336
Description
Improper neutralization of special elements used in a template engine in Elastic Cloud Enterprise (ECE) can lead to a malicious actor with Admin access exfiltrating sensitive information and issuing commands via a specially crafted string where Jinjava variables are evaluated.
References
Status: profiled · ingested 2026-10-01T18:00:02.000Z