Executive brief
Grafana, a popular data visualization and monitoring platform, is vulnerable to a security flaw in its trace viewing component. Malicious code hidden within system error logs (stack traces) can be executed in a user's browser when they view specific data from Jaeger HTTP sources. This could allow an attacker to steal session information or perform unauthorized actions on behalf of the user.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Grafana's TraceView component. The root cause is the improper neutralization of input in the 'KeyValuesTable' component, where stack traces from Jaeger HTTP API data sources are rendered as raw HTML instead of sanitized text. An attacker can exploit this by injecting malicious JavaScript into a stack trace field within a Jaeger-compatible data source. When a victim views the affected trace in the Explore Traces view, the script executes in their browser. The vulnerability is mitigated by the requirement for specific data source configurations (Jaeger HTTP API) and user interaction to view the malicious trace. Patches have been released in versions 12.2.5 and 12.3.3 which implement DOMPurify for HTML sanitization.
Affected products
- Grafana Labs Grafana >= 12.2.0, < 12.2.5; >= 12.3.0, < 12.3.3
Timeline
- 2026-02-12: disclosed
- 2026-02-12: advisory
- 2026-05-11: patched: Advisory updated with patch information
References
- https://grafana.com/security/security-advisories/CVE-2025-41117
- https://github.com/grafana/grafana/commit/4f624a5a01404da45d60063ae1ee2f184818cd42
- https://github.com/grafana/grafana/commit/8dfa6446942873d76cd94c63a2d6b71a25e880da
- https://github.com/grafana/grafana/commit/ecff0d88680cea4ad32709cb3b94b790a7f58d25