Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-9029US | medium5.4 | — | ||
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the bro… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/grafana/grafanaPACKAGE
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1WEB
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29WEB
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4WEB
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58WEB
- https://github.com/grafana/grafana/releases/tag/v12.4.4WEB
- https://github.com/grafana/grafana/releases/tag/v13.0.2WEB
- https://grafana.com/security/security-advisories/cve-2026-9029WEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan