Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Grafana's Explore Traces view allows malicious JavaScript injection

CVE-2025-41117 · published 8 months ago
Summary

Grafana's Explore Traces feature allows attackers to inject malicious code into the browser. This is a risk if a malicious user can enter JavaScript into the stack trace field. Jaeger HTTP API users should ensure they only use trusted data sources.

What to do
  • Update github.com grafana to version 12.2.5.
  • Update github.com grafana to version 12.3.3.
  • Update grafana to version 12.3.2.
  • Update grafana grafana/grafana to version 12.2.4+security-01 or later.
  • Update grafana grafana/grafana-enterprise to version 12.2.4+security-01 or later.
Affected software
Ecosystem VendorProductAffected versions
– grafana grafana >= 12.2.0, < 12.2.4
>= 12.3.0, < 12.3.2
12.2.4
12.3.2
cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*
go github.com grafana >= 12.2.0, < 12.2.5
>= 12.3.0, < 12.3.3
Fix: upgrade to 12.2.5
Bitnami – grafana >= 12.3.0, < 12.3.2
Fix: upgrade to 12.3.2
Go grafana github.com/grafana/grafana All versions
– grafana grafana/grafana < 12.2.4+security-01
– grafana grafana/grafana-enterprise < 12.2.4+security-01
Original advisory text
XSS in Grafana Explore stack trace
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published12 Feb 2026
Updated3 Nov 2026
First seen6 Mar 2026
Sources
CVE-2025-41117 · NVD
GHSA-cqp7-wf4c-3xgc · GHSA
BIT-grafana-2025-41117 · OSV
GO-2026-5332 · OSV
CVE-2025-41117 · MITRE
CVE-2025-41117 · OSV
Track software like this
Free during beta