Elastic Kibana versions 7.0.0 and 8.0.0 suffer from improper output neutralization for logs (CWE-116), enabling log injection attacks (CAPEC-93). An attacker can supply crafted input that is logged without proper escaping, which when viewed in terminals interpreting control sequences, can manipulate the displayed log output. This vulnerability has a CVSS 3.1 score of 8.0, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided, and the vulnerability is not known to be exploited in the wild.

Successful exploitation can lead to log injection, allowing an attacker to tamper with or forge log entries as displayed in terminal viewers. This can mislead administrators or security analysts by altering log data presentation, potentially hiding malicious activity or causing confusion. The vulnerability impacts confidentiality, integrity, and availability according to the CVSS vector. However, there is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when viewing Kibana logs in terminals that interpret control sequences. Consider using log viewers or environments that do not process control sequences or implement additional log sanitization measures externally.