GHSA-9g84-39mm-q4p3
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
At a glance
- Published
- Updated
- CVE
- CVE-2026-9029
- Aliases
- BIT-grafana-2026-9029, GO-2026-6542
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Description
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/grafana/grafana | introduced 2.0.0-beta1 |
| Go · github.com/grafana/grafana | introduced 13.0.0 |
| Go · github.com/grafana/grafana | introduced 0, fixed 1.9.2-0.20260616075434-82ef13993059 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9029 ADVISORY
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1 WEB
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29 WEB
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4 WEB
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58 WEB
- https://github.com/grafana/grafana PACKAGE
- https://github.com/grafana/grafana/releases/tag/v12.4.4 WEB
- https://github.com/grafana/grafana/releases/tag/v13.0.2 WEB
- https://grafana.com/security/security-advisories/cve-2026-9029 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |