Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug
The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix
GHSA-9g84-39mm-q4p3
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-9g84-39mm-q4p3
github.com/grafana/grafana
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
github.com/grafana/grafana
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
github.com/grafana/grafana
Source reference: /affected/2/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.9.2-0.20260616075434-82ef13993059
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "2.0.0-beta1"
}
]
}
],
"package": {
"name": "github.com/grafana/grafana",
"purl": "pkg:golang/github.com/grafana/grafana",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9g84-39mm-q4p3/GHSA-9g84-39mm-q4p3.json",
"last_known_affected_version_range": "< 12.4.4"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "13.0.0"
}
]
}
],
"package": {
"name": "github.com/grafana/grafana",
"purl": "pkg:golang/github.com/grafana/grafana",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9g84-39mm-q4p3/GHSA-9g84-39mm-q4p3.json",
"last_known_affected_version_range": "< 13.0.2"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.9.2-0.20260616075434-82ef13993059"
}
]
}
],
"package": {
"name": "github.com/grafana/grafana",
"purl": "pkg:golang/github.com/grafana/grafana",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-9g84-39mm-q4p3/GHSA-9g84-39mm-q4p3.json"
}
}
]- Related CVEs
- CVE-2026-9029
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #23427 · Revision 1
- Added to Heist Feed
- Publisher date