CVE-2025-4123: XSS
A cross-site scripting (XSS) vulnerability exists in Grafana caused by client path traversal and open redirect. This allows attackers to redirect users to malicious websites that execute arbitrary JavaScript through custom frontend plugins. This vulnerability does not require editor permissions (as many other XSS usually does). If anonymous access is enabled, the XSS will work.This can be abused as a full read SSRF if the Grafana Image Renderer plugin is installed.
Other sources
A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF.
The default Content-Security-Policy (CSP) in Grafana will block the XSS though the connect-src directive.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4123?
The severity of CVE-2025-4123 is classified as high due to its potential to allow redirection to malicious sites and execution of arbitrary JavaScript.
How do I fix CVE-2025-4123?
To fix CVE-2025-4123, update to the Grafana version 0.0.0-20250521183405-c7a690348df7 or later.
What products are affected by CVE-2025-4123?
CVE-2025-4123 affects both Grafana OSS and Enterprise editions.
What type of vulnerability is CVE-2025-4123?
CVE-2025-4123 is a cross-site scripting (XSS) vulnerability caused by client path traversal and open redirects.
Is user permission required to exploit CVE-2025-4123?
No, CVE-2025-4123 does not require editor permissions for exploitation.