{"cve":"CVE-2025-4123","nvd":{"published":"2025-05-22T08:15:52.720","modified":"2026-06-17T09:32:33.100","status":"Modified","description":"A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.\n\nThe default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1},"cwes":["CWE-79","CWE-601"],"references":["https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/","https://grafana.com/security/security-advisories/cve-2025-4123/","https://www.exploit-db.com/exploits/52491"],"products":["grafana:grafana"],"source":"nvd","synced_at":"2026-10-19T22:01:57.636215869+00:00"},"epss":{"cve":"CVE-2025-4123","score":0.97083,"percentile":0.99892,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-q53q-gxq9-mgrj","url":"https://osv.dev/vulnerability/GHSA-q53q-gxq9-mgrj","summary":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin","modified":"2026-09-10T03:50:24.585134887Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["<0.0.0-20250521183405-c7a690348df7"],"fixed":["0.0.0-20250521183405-c7a690348df7"]}]},{"id":"GO-2025-3704","url":"https://osv.dev/vulnerability/GO-2025-3704","summary":"Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin in github.com/grafana/grafana","modified":"2026-06-19T18:29:27.291963064Z","packages":[{"ecosystem":"Go","name":"github.com/grafana/grafana","purl":"pkg:golang/github.com/grafana/grafana","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}