GHSA-9g84-39mm-q4p3
Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
Quick fix
GHSA-9g84-39mm-q4p3 — github.com/grafana/grafana: upgrade to the fixed version with the command below.
go get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059Details
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
Are you affected?
Enter the version of the package you're using.
Affected packages
2.0.0-beta1No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
13.0.0No fixed version published yet for github.com/grafana/grafana (go modules). Pin to a known-safe version or switch to an alternative.
0Fixed in: 1.9.2-0.20260616075434-82ef13993059go get github.com/grafana/grafana@v1.9.2-0.20260616075434-82ef13993059References
- https://nvd.nist.gov/vuln/detail/CVE-2026-9029[ADVISORY]
- https://github.com/grafana/grafana/commit/3fcdbc5a6e5c955bd42bd3715dd03cbad2b078c1[WEB]
- https://github.com/grafana/grafana/commit/42cdc39124912a8506a0c613c319c345aa950b29[WEB]
- https://github.com/grafana/grafana/commit/82ef13993059351bf21de35b8488bbd9b42df4f4[WEB]
- https://github.com/grafana/grafana/commit/dc695b9649530064e19c7c120bd6ebe104908e58[WEB]
- https://github.com/grafana/grafana[PACKAGE]
- https://github.com/grafana/grafana/releases/tag/v12.4.4[WEB]
- https://github.com/grafana/grafana/releases/tag/v13.0.2[WEB]
- https://grafana.com/security/security-advisories/cve-2026-9029[WEB]