CVE-2025-41117

XSS in Grafana Explore stack trace

Medium · published February 12, 2026

CVSS v3.1
6.8
EPSS
0%
Percentile
18.7
In the wild
Unconfirmed
What it is

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00273 · 18.7th percentile
Published
2026-02-12T08:49Z
EPSS history
Timeline
  • 12 FEB 08:49Z
    XSS in Grafana Explore stack trace
    cvelistv5