Cross-site Scripting (XSS)

github.com/grafana/grafana is vulnerable to cross-site scripting XSS. The vulnerability exists when specifying series alias such as test data or elastic search, which allows special characters, caused by the bs-typeahead directive that evals the select options passed to it...

WS-2020-0412

In Grafana, versions v2.5.0 through v7.0.6 are vulnerable to Cross-Site Scripting, due to user input not sanitized properly in the series alias field, and also not escaped when rendered back to the client using typeahead. An attacker can name a series alias with arbitrary javascript code that wil...