CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard (stored cross-site scripting).
- CVSS 3.1
- 5.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-25)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- grafana:grafana
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9g84-39mm-q4p3 | Go | github.com/grafana/grafana | >=2.0.0-beta1 | no fix published |
| GHSA-9g84-39mm-q4p3 | Go | github.com/grafana/grafana | >=13.0.0 | no fix published |
| GHSA-9g84-39mm-q4p3 | Go | github.com/grafana/grafana | <1.9.2-0.20260616075434-82ef13993059 | 1.9.2-0.20260616075434-82ef13993059 |
| GO-2026-6542 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6542 | Go | github.com/grafana/grafana | all versions | no fix published |
| GO-2026-6542 | Go | github.com/grafana/grafana | >=2.0.0-beta1+incompatible | no fix published |