repository icon
elastic / elasticsearch-py Project repository

Official Python client for Elasticsearch

Submit a report

FIRST INTERACTION

WITHINN/A DAYS

REVIEW

WITHIN22 DAYS

FIX

WITHINN/A DAYS

Sniffing trusts unverified node discovery response, leaking credentials to attac...
kalendra456
duplicate
High
Node Sniffing Callback Trusts Server-Supplied `publish_address` Without Validati...
penguinmiaou
self closed
ES|QL injection via missing _render_value() in InstrumentedExpression.in_() allo...
snakeyworm
duplicate
Critical
client_node_configs() mutates shared headers across node iterations, leaking one...
jasanpes
pending
Sniffing callback trusts server-controlled publish_address and forwards seed Aut...
jasanpes
duplicate
High
SSRF and Credential Leakage via Node Sniffing Response in elasticsearch-py
ryan-fanpierlabs-security-finder
duplicate
None
ES|QL Injection via Unsanitized String Interpolation in ESQL Query Builder
ryan-fanpierlabs-security-finder
pending
ES|QL injection via missing _render_value() in InstrumentedExpression.in_() allo...
wormysnake
duplicate
Critical
SSRF + Credential Leakage via Node Sniffing — Unvalidated publish_address Inject...
orel-asper
duplicate
High
Unauthenticated Mass Data Deletion via GET Request (CSRF)
h0rk1p
self closed
NoSQL/Script Injection via DSL Q() Body Passthrough
h0rk1p
pending
ES|QL Injection via where()/eval()/stats() - No Input Sanitization
h0rk1p
not applicable
ES|QL Injection via ENRICH policy name - missing _format_id() validation
javitoia
pending
ES|QL Injection via InstrumentedExpression.in_() mising value sanitization
javitoia
pending
HTTP Header Injection via Missing CRLF Validation in bearer_auth, opaque_id, and...
javitoia
self closed
_format_id() skips all escaping for wildcard patterns, allowing ES|QL injection...
zeroxjacks
pending
Security validation checks implemented using assert statements are silently bypa...
zeroxjacks
not applicable
ES|QL Injection via Unescaped Index Identifiers in ESQL.from_() and ESQL.ts()
5afagy
pending
Exposure of Sensitive System Information via Verbose Stack Trace When Indexing U...
luciusaskaner
pending
ES|QL Pipe Injection via Query Builder
richorama
pending
Painless script injection in DenseVectorScriptScoreStrategy via unsanitized vect...
hax1ng
duplicate
High
ES|QL Injection via unsanitized string inputs in ESQL query builder allows cross...
hax1ng
duplicate
High
ES|QL Command Injection via Unescaped Policy/Value Parameters in Query Builder
moonster8282
duplicate
High
ES|QL Injection via Missing Identifier Escaping in Multiple Query Builder Comman...
alrightryanx
duplicate
High
Sniffing Accepts Untrusted Publish Addresses
chawdamrunal
pending
CRITICAL SECURITY VULNERABILITY: Path Traversal in elasticsearch-py
7908837174
spam
ES|QL Injection via Backtick Escaping Bug in `elasticsearch-py`
ava0-0sec
pending
Security Vulnerability Report: Script Injection in Vectorstore Strategies
chawdamrunal
not applicable
Improper Input Validation allows unsafe scripting DSL to be passed into `UpdateB...
zig0ta
pending
huntr: elastic/elasticsearch-py