This vulnerability (CWE-94) in Elastic Fleet Server arises because Kibana accepts an identifier for output configuration without sanitizing or restricting it to safe characters. The identifier is then incorporated into a server-side script built by Fleet Server as part of routine agent policy processing. As a result, script syntax embedded in the identifier is executed as code rather than treated as data, enabling code injection attacks. The affected versions explicitly include 8.5.0, 9.0.0, and 9.5.0. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.

Successful exploitation allows an attacker with high privileges to execute arbitrary code on the Fleet Server by injecting malicious script content. This can lead to a complete compromise of confidentiality and integrity of the affected system. Availability impact is not indicated. The vulnerability requires network access and high privileges, with no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is provided, users should monitor Elastic's advisories for updates. Restricting access to Fleet Server and limiting privileges may reduce risk until a patch is available.