GitHub Advisoryadvisory · Go

GHSA-9g84-39mm-q4p3 Grafana geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug

HIGH Published 2026-06-22 Modified 2026-09-21 Official page ↗
Aliases
CVE-2026-9029
Ecosystem
Go
Packages
github.com/grafana/grafana
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-79
Reviewed
2026-09-21

Affected packages

• Go github.com/grafana/grafana: < 12.4.4 (no fix yet) • Go github.com/grafana/grafana: < 13.0.2 (no fix yet) • Go github.com/grafana/grafana: < 1.9.2-0.20260616075434-82ef13993059 → fixed in 1.9.2-0.20260616075434-82ef13993059

Description

The geomap panel's XYZ tile layer has a sanitize-then-interpolate ordering bug. sanitizeTextPanelContent() runs on the raw template string before getTemplateSrv().replace() substitutes the variable value, which uses the glob format with no HTML escaping. The result is passed to OpenLayers via element.innerHTML. An Editor can set a textbox variable's default value to an XSS payload that executes for every user who opens the dashboard. This is a bypass of the CVE-2023-0507 fix

Related

Alias · CVE (1)

  • CVE-2026-9029 A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References