CVE-2023-0594

HIGH

Grafana vulnerable to Cross-site Scripting

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2023-0594 has a selected CVSS score of 7.3 (high).

Description

Grafana is an open-source platform for monitoring and observability. Starting with the 7.0 branch, Grafana had a stored XSS vulnerability in the trace view visualization. The stored XSS vulnerability was possible due the value of a span's attributes/resources were not properly sanitized and this will be rendered when the span's attributes/resources are expanded. An attacker needs to have the Editor role in order to change the value of a trace view visualization to contain JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard. Users may upgrade to version 8.5.21, 9.2.13 and 9.3.8 to receive a fix.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 27, 2026 · Source: CVE List

Affected products and versions

3
ProductSourceVersion range

Grafana

Browse Grafana / Grafana

Default status: unaffected

CVE List7.0.0 to < 8.5.21affected
9.0.0 to < 9.2.13affected
9.3.0 to < 9.3.8affected

Grafana Enterprise

Browse Grafana / Grafana Enterprise

Default status: unaffected

CVE List7.0.0 to < 8.5.21affected
9.0.0 to < 9.2.13affected
9.3.0 to < 9.3.8affected

github.com/grafana/grafana

Browse Go / github.com/grafana/grafana
GitHub Advisory7.0.0 to < 8.5.21 · Fixed in 8.5.21affected
9.0.0 to < 9.2.13 · Fixed in 9.2.13affected
9.3.0 to < 9.3.8 · Fixed in 9.3.8affected

References

4