GHSA-3c93-92r7-j934

Grafana Infinity Datasource Plugin SSRF Vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-8341

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/grafana/grafana-infinity-datasource	< 1.4.2-0.20250731100004-9c736aa21b3a	1.4.2-0.20250731100004-9c736aa21b3a

Details

As written in the advisory (Markdown source, shown as plain text).

Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2025-8341 advisory
https://github.com/grafana/grafana-infinity-datasource/commit/9c736aa21b3a669d3070d3f5f80d949326fafa77 web
https://github.com/grafana/grafana-infinity-datasource package
https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1 web
https://grafana.com/security/security-advisories/cve-2025-8341 web