CVE-2025-4123 Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin
Attackers can execute arbitrary JavaScript via XSS or read internal data via SSRF in Grafana, potentially compromising user sessions and sensitive information.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-4123?
CVE-2025-4123 is a high-severity cross-site scripting vulnerability in Grafana Grafana, published on 22 May 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.
The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive.
Which versions are affected by CVE-2025-4123?
4 open source packages ship an affected version, including github.com/grafana/grafana and grafana. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/grafana/grafana Go | All versions | None |
github.com/grafana/grafana Go | All versions | 0.0.0-20250521183405-c7a690348df7 |
github.com/grafana/grafana Go | All versions | 0.0.0-20250521183405-c7a690348df7 |
grafana Bitnami | All versions | 10.4.18, 11.6.1, 12.0.0 |
Linux distribution packages (36)
grafana AlmaLinux:8 | All versions | 9.2.10-23.el8_10 |
grafana-selinux AlmaLinux:8 | All versions | 9.2.10-23.el8_10 |
grafana AlmaLinux:9 | All versions | 10.2.6-13.el9_6 |
grafana-selinux AlmaLinux:9 | All versions | 10.2.6-13.el9_6 |
grafana Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-17.el10_0 |
grafana-debuginfo Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-17.el10_0 |
grafana-debugsource Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-17.el10_0 |
grafana-selinux Red Hat:enterprise_linux:10.0 | All versions | 0:10.2.6-17.el10_0 |
grafana Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-23.el8_10 |
grafana-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-23.el8_10 |
grafana-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-23.el8_10 |
grafana-selinux Red Hat:enterprise_linux:8::appstream | All versions | 0:9.2.10-23.el8_10 |
grafana Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-13.el9_6 |
grafana-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-13.el9_6 |
grafana-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-13.el9_6 |
grafana-selinux Red Hat:enterprise_linux:9::appstream | All versions | 0:10.2.6-13.el9_6 |
grafana Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-azure-monitor Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-cloudwatch Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-debuginfo Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-elasticsearch Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-graphite Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-influxdb Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-loki Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-mssql Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-mysql Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-opentsdb Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-postgres Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-prometheus Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana-stackdriver Red Hat:rhel_aus:8.2::appstream | All versions | 0:6.3.6-7.el8_2 |
grafana Red Hat:rhel_aus:8.4::appstream | All versions | 0:7.3.6-9.el8_4 |
grafana-debuginfo Red Hat:rhel_aus:8.4::appstream | All versions | 0:7.3.6-9.el8_4 |
grafana Red Hat:rhel_aus:8.6::appstream | All versions | 0:7.5.11-6.el8_6 |
grafana-debuginfo Red Hat:rhel_aus:8.6::appstream | All versions | 0:7.5.11-6.el8_6 |
grafana Red Hat:rhel_e4s:8.6::appstream | All versions | 0:7.5.11-6.el8_6 |
grafana-debuginfo Red Hat:rhel_e4s:8.6::appstream | All versions | 0:7.5.11-6.el8_6 |
Products include Grafana Grafana.
How do I fix CVE-2025-4123?
Upgrade github.com/grafana/grafana to 0.0.0-20250521183405-c7a690348df7 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-4123 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-4123 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 5 proofs of concept on GitHub.
Other vulnerabilities in Grafana Grafana
Sources
Also known as ALSA-2025:7893, ALSA-2025:7894, BIT-grafana-2025-4123, GHSA-q53q-gxq9-mgrj, GO-2025-3704, MINI-2h6v-mc85-j229 and 27 more.