cve.bz

CVE-2025-8341

5.0 mediumEPSS 0.3%

Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints. If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.

Severity

CVSS 3.1

5.0 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
CWE
CWE-918
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-3c93-92r7-j934Gogithub.com/grafana/grafana-infinity-datasource<1.4.2-0.20250731100004-9c736aa21b3a1.4.2-0.20250731100004-9c736aa21b3a
GO-2025-3843Gogithub.com/grafana/grafana-infinity-datasource<1.4.2-0.20250731100004-9c736aa21b3a1.4.2-0.20250731100004-9c736aa21b3a

References

Check your stackJSON