Advisory ROSA-SA-2026-3252

software: grafana 12.1.8 WASP: ROSA-CHROME unaffected versions = grafana-12.1.8-1 affected versions 3s, timeout and permanently block on sending to an unbuffered channel, resulting in linear growth of goroutines and memory exhaustion. CVE-STATUS: The vulnerability has been resolved CVE-REV: To...

The vulnerability of the Custom Frontend Plugin component of the Grafana monitoring and observation platform allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the Custom Frontend Plugin component of the Grafana monitoring and observation platform is related to improper input validation during the creation of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting XSS attacks remotely...

Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin

A cross-site scripting XSS vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permission...