CVE-2025-41117 XSS in Grafana Explore stack trace

What is CVE-2025-41117?

CVE-2025-41117 is a medium-severity cross-site scripting vulnerability in Grafana Grafana, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field.

Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo do not appear affected whatsoever.

Weakness: CWE-79

Which versions are affected by CVE-2025-41117?

6 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.

Products include Grafana Grafana.

How do I fix CVE-2025-41117?

Upgrade github.com/grafana/grafana to a fixed version for your release line: 12.2.5 or 12.3.3.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-41117 being exploited?

There is no known exploitation of CVE-2025-41117 in the wild and no public exploit code.

Other vulnerabilities in Grafana Grafana

• CVE-2021-43798 Grafana Path Traversal Exploited High 7.5
• CVE-2025-41115 Incorrect privilege assignment Critical 10.0
• CVE-2022-39328 Grafana vulnerable to race condition allowing privilege escalation Critical 9.8
• CVE-2022-28660 Auth bypass in n/a Critical 9.8
• CVE-2022-26148 Information disclosure in n/a Critical 9.8

All Grafana Grafana vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-grafana-2025-41117, GHSA-cqp7-wf4c-3xgc, GO-2026-5332, MINI-jjq4-8gvq-x7x2, MINI-mmcc-h9qq-8ww9, MINI-v7mv-6q7g-j3mq and 2 more.