CVE-2025-41117

MEDIUM

6.8

Description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Details CVE

Score CVSS v3.16.8

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Vecteur d'attaqueNETWORK

ComplexiteHIGH

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie2/12/2026

Derniere modification2/26/2026

Sourcenvd

Observations honeypot0

Produits affectes

grafana:grafana

Faiblesses (CWE)

CWE-79CWE-79

References

https://grafana.com/security/security-advisories/cve-2025-41117(security@grafana.com)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.