VulnerabilityModified

CVE-2025-41117

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser.

MEDIUM 6.1EPSS 0.24%

Does this matter?

Lower severity and a low EPSS score (0.24%). Track it; it rarely justifies an emergency change on its own.

Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

CVSS 3.1: 6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 0.24% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: grafana/grafana
Source: security@grafana.com

References

https://grafana.com/security/security-advisories/cve-2025-41117Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.