Homepage

Information Exposure Affecting kibana-9.4-advanced package, versions <9.4.4-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.35% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-KIBANA94ADVANCED-20653836
  • published9 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-106120  (opens in a new tab)
CWE-200  (opens in a new tab)

How to fix?

Upgrade Minimos:latest kibana-9.4-advanced to version 9.4.4-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kibana-9.4-advanced package and not the kibana-9.4-advanced package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not consistently restrict inherited array indices because negative indexing, .first, .last, the first filter, the last filter, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker who can influence prototype state or inherited array-index data and cause templates to render affected operations can disclose values that ownPropertyOnly is expected to hide. Direct positive indexing and ordinary object prototype reads are blocked, but the alternate array paths remain affected. This issue is fixed in 10.27.2.