← CVE Intelligence

CVE-2025-41117

XSS in Grafana Explore stack trace PUBLISHED

Description (CNA)

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Affected (CNA)

Vendor / productVersions
Grafana / grafana/grafanaaffected 12.2.0 before 12.2.4+security-01; affected 12.3.0 before 12.3.2+security-01
Grafana / grafana/grafana-enterpriseaffected 12.2.0 before 12.2.4+security-01; affected 12.3.0 before 12.3.2+security-01

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.