Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2025-41117

XSS in Grafana Explore stack trace

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
GRAFANA

Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Grafana grafana/grafana

Default version status: unaffected

  • 12.2.0 to < 12.2.4+security-01affected
  • 12.3.0 to < 12.3.2+security-01affected

Grafana grafana/grafana-enterprise

Default version status: unaffected

  • 12.2.0 to < 12.2.4+security-01affected
  • 12.3.0 to < 12.3.2+security-01affected

References