GitHub Advisoryadvisory · Go
GHSA-3c93-92r7-j934 Grafana Infinity Datasource Plugin SSRF Vulnerability
MEDIUM
Official page ↗
- Aliases
- CVE-2025-8341
- Ecosystem
- Go
- Packages
- github.com/grafana/grafana-infinity-datasource
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
- Weaknesses
- CWE-918
- Reviewed
- 2025-08-04
Affected packages
• Go github.com/grafana/grafana-infinity-datasource: < 1.4.2-0.20250731100004-9c736aa21b3a → fixed in 1.4.2-0.20250731100004-9c736aa21b3a
Description
Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from JSON, CSV, XML, GraphQL, and HTML endpoints.
If the plugin was configured to allow only certain URLs, an attacker could bypass this restriction using a specially crafted URL. This vulnerability is fixed in version 3.4.1.
Related
Alias · CVE (1)
- CVE-2025-8341 Grafana is an open-source platform for monitoring and observability. vulnerability
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-8341 advisory
- https://github.com/grafana/grafana-infinity-datasource/commit/9c736aa21b3a669d3070d3f5f80d949326fafa77 web
- https://github.com/grafana/grafana-infinity-datasource package
- https://github.com/grafana/grafana-infinity-datasource/releases/tag/v3.4.1 web
- https://grafana.com/security/security-advisories/cve-2025-8341 web