6.8
Medium
CVE-2025-41117 Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the…
Description
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| grafana/grafana 12.3 | 12.3.0 → < 12.3.2+security-01 | 12.3.2+security-01 |
| grafana/grafana 12.2 | 12.2.0 → < 12.2.4+security-01 | 12.2.4+security-01 |
| grafana/grafana-enterprise 12.3 | 12.3.0 → < 12.3.2+security-01 | 12.3.2+security-01 |
| grafana/grafana-enterprise 12.2 | 12.2.0 → < 12.2.4+security-01 | 12.2.4+security-01 |
References
- grafana.com grafana.com
Timeline
- Published
- Last modified
Other CVEs of grafana/grafana
The 4 CVEs of grafana/grafana →
CVE-2026-21722
Public dashboards with annotations enabled did not limit their annotation timerange to the locked timerange of the…
5.3
Medium
CVE-2026-21721
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:*…
8.1
High
CVE-2026-21720
Every uncached /avatar/:hash request spawns a goroutine that refreshes the Gravatar image
7.5
High