XSS vulnerability allowing arbitrary JavaScript execution

Description

Today we are releasing Grafana 8.2.3. This patch release includes an important security fix for an issue that affects all Grafana versions from 8.0.0-beta1.

Grafana Cloud instances have already been patched and an audit did not find any usage of this attack vector. Grafana Enterprise customers were provided with updated binaries under embargo.

Recommendation

Update the @grafana/data package to the latest compatible version. Followings are version details:

• Affected version(s): >= 8.0.0, < 8.2.3
• Patched version(s): 8.2.3

References

• GHSA-3j9m-hcv9-rpj8
• security.netapp.com
• CVE-2021-41174
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• HAX CMS: Stored XSS via '<video-player>' component allows arbitrary JavaScript execution and token theft - CVE-2026-46496
• [thi.ng/egf] Potential arbitrary code execution of `#gpg`-tagged property values - CVE-2021-21412
• jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and "AS" pr - CVE-2026-25940
• PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF - CVE-2024-4367

You might also like:

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

How to Secure your NodeJs Express Javascript Application - part 1

Tags:

npm

@grafana/data