# Kibana 8.19.9 – Multiple HIGH severity dependency vulnerabilities (npm & OS packages)

**URL:** <https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536>\
**Category:** Kibana\
**Tags:** docker\
**Created:** [January 14, 2026, 10:12am UTC](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536 "2026-01-14T10:12:12Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Shanmuga\_Sundaram\_Mu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shanmuga_sundaram_mu/32/142148_2.png) [@Shanmuga\_Sundaram\_Mu](https://discuss.elastic.co/u/Shanmuga_Sundaram_Mu)\
**Post date:** [January 14, 2026, 10:12am UTC](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536/1 "2026-01-14T10:12:12Z")

</div>

### **Product Details**

- **Product:** Kibana

- **Version:** 8.19.9

- **Deployment:** Self-managed / Community

- **Build type:** Official Elastic Docker / tar distribution

- **Issue category:** Third-party dependency vulnerabilities

* * *

### 🛑 **Identified Vulnerabilities**

#### 1. LangChain – Serialization Injection

- **Package:** `@langchain/core`

- **Installed:** 0.3.57

- **Fixed in:** 0.3.80

- **GHSA:** GHSA-r399-636x-v7f6

- **Severity:** HIGH

- **Impact:** Potential secret extraction via unsafe serialization

#### 2. LangChain (core package)

- **Package:** `langchain`

- **Installed:** 0.3.15

- **Fixed in:** 0.3.37

- **GHSA:** GHSA-r399-636x-v7f6

- **Severity:** HIGH

#### 3. expr-eval – Prototype Pollution

- **Package:** `expr-eval`

- **Installed:** 2.0.2

- **GHSA:** GHSA-8gw3-rxh4-v6jx

- **Severity:** HIGH

- **Impact:** Prototype pollution via crafted expressions

#### 4. expr-eval – Unsafe function execution

- **Package:** `expr-eval`

- **Installed:** 2.0.2

- **GHSA:** GHSA-jc85-fpwf-qm7x

- **Severity:** HIGH

#### 5. systeminformation – Command Injection (Windows)

- **Package:** `systeminformation`

- **Installed:** 5.23.8

- **Fixed in:** 5.27.14

- **GHSA:** GHSA-wphj-fx3q-84ch

- **Severity:** HIGH

#### 6. gpgv – OS package vulnerability

- **Package:** `gpgv`

- **Installed:** 2.4.4-2ubuntu17.3

- **Fixed in:** 2.4.4-2ubuntu17.4

- **CVE:** CVE-2025-68973

- **Severity:** HIGH

* * *

### 🎯 **Questions for Elastic Security Team**

1. Are these vulnerabilities considered **reachable / exploitable** in Kibana 8.19.9?

2. Will these be addressed in the **next 8.19.x patch release**?

3. Is there an **estimated remediation timeline**?

4. Are there **recommended mitigations** until a patch is released?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [January 14, 2026, 10:13am UTC](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536/2 "2026-01-14T10:13:21Z")

</div>

Welcome!

Is it a post generated with AI?

Anyway, thank you for your report.

Elastic's security reporting guidelines are available at [Product Security at Elastic | Elastic](https://www.elastic.co/community/security) .

Per those guidelines, all reports of potential security issues or vulnerabilities should be sent via email to [security@elastic.co](mailto:security@elastic.co).

We are unable to discuss potential issues of this nature here. Please send your report to the email address above, where it can be appropriately handled.