~ / search / GHSA-9g84-39mm-q4p3

GHSA-9g84-39mm-q4p3

Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug

Source: GitHub Advisory Database (reviewed) High CVE-2026-9029

Packages

EcosystemPackageAffectedFixed in
Go github.com/grafana/grafana < 12.4.4 no fix listed
Go github.com/grafana/grafana < 13.0.2 no fix listed
Go github.com/grafana/grafana < 1.9.2-0.20260616075434-82ef13993059 1.9.2-0.20260616075434-82ef13993059

Details

As written in the advisory (Markdown source, shown as plain text).

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix

References

External links from the advisory. They lead to third-party sites.