Executive brief
Grafana is a popular data visualization platform used to create dashboards for monitoring systems and applications. A security flaw in the geomap panel allows a user with 'Editor' permissions to inject malicious code into a dashboard. When other users view the affected dashboard, this code executes in their browser, potentially allowing the attacker to steal sensitive information or perform actions on their behalf.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Grafana's geomap panel XYZ tile layer due to a 'sanitize-then-interpolate' ordering bug. The 'sanitizeTextPanelContent()' function is executed on the raw template string before 'getTemplateSrv().replace()' performs variable substitution. Because the substitution uses a glob format without HTML escaping, the resulting unsanitized content is passed directly to OpenLayers via 'element.innerHTML'. An attacker with Editor permissions can set a textbox variable's default value to an XSS payload, which then executes in the context of any user viewing the dashboard. This vulnerability represents a bypass of the previous fix for CVE-2023-0507.
Affected products
- Grafana Grafana OSS 12.4.0
Timeline
- 2026-06-22: disclosed
- 2026-06-22: advisory