Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-9029US | medium5.4 | — | ||
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the bro… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/grafana/grafanaPACKAGE
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1WEB
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29WEB
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4WEB
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58WEB
- https://github.com/grafana/grafana/releases/tag/v12.4.4WEB
- https://github.com/grafana/grafana/releases/tag/v13.0.2WEB
- https://grafana.com/security/security-advisories/cve-2026-9029WEB
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan