CVE-2025-41117

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://grafana.com/security/security-advisories/cve-2025-41117	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana::::::::
	cpe:2.3:a:grafana:grafana:12.2.4:-::::::
	cpe:2.3:a:grafana:grafana:12.3.2:-::::::

History

No history.

Information

Published : 2026-02-12 09:16

Updated : 2026-02-26 22:20

NVD link : CVE-2025-41117

Mitre link : CVE-2025-41117

CVE.ORG link : CVE-2025-41117

JSON object : View

Products Affected

grafana

grafana

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-41117", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@grafana.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2026-02-12T09:16:07.630", "references": [{"url": "https://grafana.com/security/security-advisories/cve-2025-41117", "tags": ["Broken Link"], "source": "security@grafana.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.\n\nOnly datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever."}, {"lang": "es", "value": "Las trazas de pila en la vista 'Explore Traces' de Grafana pueden renderizarse como HTML sin procesar y, por lo tanto, inyectar JavaScript malicioso en el navegador. Esto requerir\u00eda que se introduzca JavaScript malicioso en el campo de traza de pila.\n\nSolo las fuentes de datos con la API HTTP de Jaeger parecen estar afectadas; Jaeger gRPC y Tempo no parecen afectadas en absoluto."}], "lastModified": "2026-02-26T22:20:42.667", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2BDFDFB-565D-4E2C-B32F-E4B66630CA19", "versionEndExcluding": "12.2.4", "versionStartIncluding": "12.2.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2D8F9839-C15D-496A-8B0C-92D7C7916BFB", "versionEndExcluding": "12.3.2", "versionStartIncluding": "12.3.0"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.2.4:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CF2D10C-CEE9-4D8C-9D46-F38DE3540FB5"}, {"criteria": "cpe:2.3:a:grafana:grafana:12.3.2:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63FB712A-04AC-42FD-AC3C-1384932B662E"}], "operator": "OR"}]}], "sourceIdentifier": "security@grafana.com"}