Executive brief
Grafana is a popular data visualization platform used to monitor infrastructure and applications. A security flaw allows users with dashboard editing privileges to embed malicious scripts into table panels. If another user views the compromised dashboard, the script could execute in their browser, potentially leading to unauthorized data access or session hijacking.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the Grafana TableNG panel component. The root cause is improper neutralization of input within field names, allowing an attacker with 'Editor' permissions to inject malicious JavaScript. When a victim views the affected dashboard, the script executes within the context of their browser session. This can be used to exfiltrate sensitive information or perform actions on behalf of the victim. The vulnerability is fixed in Grafana versions 12.4.4 and 13.0.2.
Affected products
- Grafana Labs Grafana OSS 12.4.0 - 12.4.3, 13.0.0 - 13.0.1
Timeline
- 2026-06-09: advisory: Initial advisory published by Grafana Labs
- 2026-07-10: disclosed: CVE published to NVD