Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Remediation

References

CVE-2025-41117

Related Vulnerabilities

WordPress Plugin Church Admin Arbitrary File Upload (4.4.6)

WordPress Plugin BulletProof Security Multiple Cross-Site Scripting Vulnerabilities (.48.9)

WordPress Plugin Ultimate Member-User Profile, Registration, Login, Member Directory, Content Restriction & Membership Cross-Site Request Forgery (2.0.6)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3900)

WordPress Plugin Consulting Elementor Widgets Local File Inclusion (1.3.0)

Severity

Medium

Classification

CVE-2025-41117 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities